Ledger Confirms Hardware Implant Linked to $93M Hack

Hardware wallet manufacturer Ledger has confirmed that a device tied to recent cryptocurrency thefts contained an unauthorized hardware implant, according to CoinDesk. All confirmed cases identified so far involve units distributed through Southeast Asian reseller CryptoBilis, which operates across Indonesia, Malaysia, and the Philippines.

While Ledger has not published an official loss figure, third-party on-chain researchers estimate that between $86 million and $93 million was drained from more than 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. Ledger emphasized that its internal security infrastructure, direct sales channels, and core systems were not compromised in the incident.

Reseller Supply-Chain Breach

In statements released on Oct. 10 and Oct. 11, Ledger confirmed the presence of the physical implant in an affected user's device, marking the first concrete evidence of supply-chain tampering following an Oct. 9 draining incident. The company stated that the volume of impacted devices appears limited and that it is cooperating with relevant authorities.

CryptoBilis has suspended sales of all hardware wallet inventory while the investigation continues. The reseller did not immediately respond to requests for comment regarding the breach or claims posted on X by Binance co-founder Changpeng Zhao alleging a corporate acquisition and non-disclosure agreement preceded the exploit.

Security Guidance for Users

Ledger instructed customers who purchased hardware wallets through CryptoBilis not to initialize unused devices. The firm advised users with active wallets from the reseller to immediately transfer their assets to a new seed phrase generated on a device sourced directly from Ledger. The manufacturer also reminded distributors to source inventory exclusively through authorized channels, strictly prohibited the restocking of returned units, and warned customers that Ledger will never ask for their 24-word recovery phrases.

Key facts

• Ledger confirmed an unauthorized physical implant in a device sold by Southeast Asian reseller CryptoBilis.
• On-chain analysts estimate $86 million to $93 million was stolen across more than 300 wallets on Bitcoin, Ethereum, and Tron.
• Ledger stated its internal infrastructure, systems, and direct sales channels remain secure.
• CryptoBilis suspended all hardware wallet sales pending an investigation with authorities.