Ledger has stated that it found a suspicious piece of hardware inside its customer’s cryptocurrency wallet, following its investigation on October 10 into the thefts linked to CryptoBilis, a Southeast Asian cryptocurrency reseller, where estimated losses are more than $86 million (roughly Rs. 8,229 crore). According to a public notice by Ledger Support, the compromised equipment was owned by a customer who is part of an investigation that is currently underway. The company stated that CryptoBilis has ceased selling any hardware wallets until the situation is resolved.
Ledger Says Its Security Infrastructure Has Not Been Compromised
There is no evidence that the implant is responsible for the cryptocurrency losses. However, the discovery confirms the physical tampering of at least one device after the reseller had issued warnings about the strange wallets that were circulating. While investigating the matter, Ledger discovered an extra electronic component within a wallet that one of the victims possessed. This component was called an “unauthorised hardware implant,” but no further details about the exact model of the device and the way it was placed into the wallet were given.
Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: bounty@ledger.fr. As a measure of precaution CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps. Ledger is working with the appropriate authorities to bring the bad actors to justice, and thanks @SEAL_911 for their collaborative support on the investigation. We have no indication that Ledger’s security infrastructure, systems or services have been compromised. As a reminder, Ledger recommends users who purchased a Ledger device from this reseller to not initiate set up if they have not yet done so. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed). Security is a constantly evolving landscape; Ledger is continuously adding security mitigations and is working on further, enhanced anti-tampering solutions. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates, and remember: Ledger will never ask for your 24-word recovery phrase. For assistance or questions, contact Ledger customer support through our official channels: https://t.co/PeTo6Z7l84
— Ledger Support (@Ledger_Support) October 10, 2026
Ledger’s press release on October 10 mentioned that the company’s security team was investigating the matter and reaching out to those customers who were possibly affected by the problem. The company has not disclosed the number of such wallets yet.
Reports of unauthorised transactions were received on October 9 from people who had bought Ledger products from CryptoBilis, a distributor based in Indonesia, Malaysia, and the Philippines. After the complaints were made, Ledger conducted an investigation into the losses reported and requested the distributor to stop selling and shipping its devices.
According to another report by The Block, on-chain analysts had initially detected suspected thefts valued at more than $72 million (roughly Rs. 6,891 crore), and another estimate suggested that there were losses of more than $86 million (roughly Rs. 8,229 crore).
However, Ledger has not yet validated either of these figures. In its latest statement, Ledger reiterated the fact that there was no proof that its security system or processes had been compromised. “We have no indication that Ledger’s security infrastructure, systems or services have been compromised,” the company stated. While Ledger is working on building more defenses against physical attacks on devices, the investigators are trying to find out how the rogue component got inside the wallet.
While the investigations continue on the compromised hardware, the blockchain analytics experts have tried to measure the total amount of cryptocurrency stolen from the victims’ wallets. According to an investigation by Bitquery carried out on October 9, a total of $92.9 million (roughly Rs. 8,891 crore) was taken from 311 wallets across Bitcoin, Ethereum, TRON, BNB Chain, and Polygon.
This number was higher compared to previous estimations of losses worth between $72 million (roughly Rs. 6,891 crore) and over $86 million (roughly Rs. 8,229 crore). Bitquery justified the variation based on the addition of more wallets and blockchain systems used for the assessment. In its research findings, the highest percentage of the suspected losses was associated with the USDT transactions on the TRON network, followed by Bitcoin and Ethereum transfers.
