Ledger has confirmed that one of the devices caught up in its Southeast Asia wallet-drain probe contained an “unauthorized hardware implant,” marking the first time the hardware-wallet maker has verified physical tampering in a case that on-chain analysts estimate has already cost users more than $86 million. In an update from its official support account, Ledger said it was reaching out to affected customers while stressing that its own security infrastructure, systems, and services were not compromised.
The finding is tied to devices sold through CryptoBilis, a reseller Ledger lists for Indonesia, Malaysia, and the Philippines. For buyers, the company’s guidance is specific: do not initialize a device you have not yet set up, and if you have already set one up, move your assets to a new wallet with a fresh recovery phrase. Here is what was confirmed, how the implant is believed to work, and what to do next.
What Ledger Confirmed
In its October 10 statement, Ledger said “one of the impacted users’ devices contained an unauthorized hardware implant,” the first company confirmation of physical tampering in the investigation it began October 9. CryptoBilis has since ceased sales of all hardware wallet inventory until the review concludes, a broader pause than Ledger’s initial request, which covered only Ledger devices.
Ledger reiterated that it has “no indication that Ledger’s security infrastructure, systems or services have been compromised.” The company also thanked the security group SEAL 911, said it was working with authorities, and warned that it will never ask for a 24-word recovery phrase.
The losses themselves remain estimates. On-chain investigator Specter put the total above $86 million across Bitcoin, Ethereum, and TRON, while Bitquery estimated about $92.9 million across 311 wallets and researcher Yfarmx put suspected losses at $93.4 million across 471 addresses. Ledger has not confirmed any of these figures.
How the Implant Is Believed to Work
The most detailed public description comes from Mark Karpelès, the former Mt. Gox chief executive, who documented a modified Ledger Nano X. The device he examined reportedly carried a concealed circuit board with an LTE module, an eSIM, and a microcontroller wired to the display’s SPI bus. Because the implant only watches the screen as the 24-word recovery phrase appears during setup, it can record the words and transmit them over cellular without ever touching the secure element that protects the private keys.
That design would explain why a tampered device could still pass Ledger’s genuine check: the secure chip and firmware are left untouched, and the implant simply reads what the screen displays. Ledger has not published its own technical findings, and it has not confirmed that this is how funds were drained.
What CryptoBilis Buyers Should Do
Ledger’s instructions split by whether the device has been set up. Anyone who bought from CryptoBilis in the past 90 days and has not initialized a device should not start setup. Anyone who has already set up a device should consider moving assets to a new Ledger signer generated with a new seed phrase, because reusing the old phrase would still expose the same keys.
Buyers should also treat the device as untrustworthy regardless of whether funds have already moved, contact Ledger through support.ledger.com, and ignore any message that asks for a recovery phrase.
Is Your Ledger Safe?
The confirmation points to a supply-chain problem at a single reseller, not a breach of Ledger’s own systems. The evidence so far is limited to devices sold through CryptoBilis, and Ledger says it is developing enhanced anti-tampering solutions. Direct buyers have not been flagged as affected.
The case is still a reminder that self-custody security extends beyond software: a wallet bought through a compromised channel can fail even when its cryptography is sound.
Frequently Asked Questions
Is my Ledger safe?
If you bought directly from Ledger, there is no indication so far that your device is affected. The confirmed implant is tied to devices sold through the CryptoBilis reseller.
Which devices are affected?
Ledger has confirmed one affected device but has not disclosed the model or how many other devices may be compromised. The investigation is ongoing.
What should I do if I bought from CryptoBilis?
Do not initialize an unused device. If you already set one up, move your assets to a new device with a new recovery phrase and contact Ledger through support.ledger.com.
Can firmware detect the implant?
Not reliably. The implant is reported to watch the display and leave the secure element untouched, which is why tampered devices can still pass a genuine check.
Rival manufacturer Trezor responded by cutting its own reseller network as a precaution, telling partners their authorization ends on January 1, 2027.
