Ledger confirmed this weekend that at least one customer hardware wallet linked to a wave of recent fund thefts contained an unauthorized hardware implant — a physical tamper device slipped into the product somewhere along its distribution path. According to the company, every confirmed case identified so far involves wallets sold through CryptoBilis, a Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines.
The disclosure marks the first hard evidence of supply-chain tampering in an incident that first surfaced on Friday, October 9, when Ledger acknowledged investigating reports of missing funds from customers who had purchased devices through the reseller. In a statement released October 10, Ledger said it had confirmed the implant in one affected device and was actively contacting impacted users as part of an ongoing investigation. CryptoBilis has since suspended sales of all hardware wallet inventory until the investigation concludes.
In a follow-up update on October 11, Ledger said the number of impacted devices appears limited. All confirmed cases tied to the draining incident reported on October 9 involve devices sold through CryptoBilis, the company said, adding that its internal systems and direct sales channels show no indication of compromise.
While Ledger has not confirmed an official loss figure, third-party on-chain researchers estimate that between 86 and 93 million dollars was drained from more than 300 wallets across Bitcoin, Ethereum, and Tron. The scale underscores why hardware wallet distributors make attractive targets: since the 2022 collapse of FTX drove millions of investors into self-custody, a single compromised reseller batch can put an enormous amount of value at risk.
Ledger's guidance for affected customers is blunt: do not initialize unused devices purchased from CryptoBilis, and if a device is already set up, move funds to a new seed phrase on a device obtained directly from Ledger. The company urged users to contact official Ledger support, file complaints with local law enforcement, and reminded its distributor network to source products exclusively through authorized channels while strictly prohibiting the restocking of returned products. It also cautioned that scammers often exploit incidents like this and reiterated that it will never call, send direct messages, or ask for a recovery phrase.
Speculation about how the supply chain was breached continues to circulate. In a post on X, Binance co-founder Changpeng Zhao alleged that the attackers bought the reseller and forced it to sign a non-disclosure agreement — claims that have not been independently verified. CryptoBilis did not respond to requests for comment.
For its part, Ledger said it is reviewing its authorized reseller controls, advancing hardware protections, and calling for broader industry improvements in chain-of-custody practices. "Security isn't static," the company said in its October 11 update, "and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes."
The episode is the second major hardware wallet security failure of the year. In July, a flaw in Coldcard's seed-generation firmware allowed attackers to drain an estimated 100 to 130 million dollars in bitcoin, according to on-chain researchers — an incident later tied to a compromised official X account at the wallet maker this past weekend.
For enterprise IT teams, the takeaway is familiar but newly urgent: the supply chain is an attack surface, and cryptographic hardware is only as trustworthy as the hands it passes through. Procurement policies that insist on direct-from-vendor sourcing, tamper-evident verification, and documented chain of custody are no longer optional for security-critical devices — they are the minimum. A ledger of secrets is only as good as the ledger of who touched the device.