Hardware wallets exist to remove one point of trust: your keys never sit on an internet-connected computer. The incident that began on October 9 shows where that trust quietly moves instead. Ledger has confirmed that at least one device sold through CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, contained an “unauthorized hardware implant.” On-chain investigators have tied tens of millions of dollars in drained wallets to buyers from that reseller.
This piece separates what Ledger and established outlets have confirmed from what is still being investigated, and then lays out the practical steps that matter for anyone holding crypto in self-custody.
What happened, in order
On October 9, Ledger said it was investigating reports of lost funds from users in Southeast Asia who had bought devices from CryptoBilis, and asked the reseller to pause all sales and shipments, according to The Block. It told anyone who had bought from that reseller in the previous 90 days not to set up their device, and anyone who already had to consider moving funds to a new device with a newly generated recovery phrase.
On October 10, Ledger confirmed the implant in one affected user’s device. In a “72 hour update” on October 11, reported by Decrypt, the company said all confirmed cases involve CryptoBilis devices, that “the volume of impacted devices is limited,” that it is working with authorities, and that CryptoBilis has ceased all hardware wallet sales. Ledger also said its own systems and direct sales channels were not affected.
The story spread quickly on X. X’s own story summary described hidden components and estimated losses in the $86 million to $93 million range, while accounts such as Bitcoin News and TFTC tracked reports that the problem may reach beyond Southeast Asia.
How big is it? The numbers are estimates
No single official loss figure exists. Ledger has not confirmed any total, and the estimates differ depending on which addresses and chains are counted:
- On-chain researcher tanuki42 initially put related addresses above $72 million, and investigator Specter estimated more than $86 million across Bitcoin, Ethereum and Tron (The Block).
- Analytics firm Bitquery later counted about $92.9 million from 311 wallets across five chains (ThreatWire).
- Crypto Briefing reported that roughly $70 million of the stolen funds were USDT on Tron.
Investigators at YFarmX told Decrypt the thief routed ETH through Tornado Cash, converted some USDT into USDD (a stablecoin Tether cannot freeze), and sent part of the funds to Binance deposit addresses, while Tether froze 10 million USDT on the first day. Those tracing findings have not been independently verified.
How the implant is believed to work
Ledger has confirmed the implant exists but has not published a full component-level teardown. Reporting and community teardowns describe the suspected method at a high level: a small extra circuit board inside the case captures the 24-word recovery phrase while the device shows it during setup, then sends it out over a cellular connection.
The key point is that this does not require breaking the secure element, the chip that protects the keys. If the recovery words appear on a compromised screen, they are effectively leaked even though the chip itself is genuine. As ThreatWire notes, Ledger’s own hardware-integrity help page says its Genuine Check proves the secure element is authentic but cannot detect physical modifications like spying implants if the original chip is intact. In other words, passing the official check is necessary, but it is not proof that a device is clean.
The European reports: still unconfirmed
On October 12, an X user named Johannes said two Ledger devices he bought at separate MediaMarkt stores in Europe showed matching modifications, including added cables and an LTE module, and called for a recall. The Defiant and Lookonchain reported that store records named distributor Aqipa GmbH as the supplier, and that one device was sent to former Mt. Gox CEO Mark Karpeles for analysis while the other is going to Ledger.
These claims rest mainly on one buyer’s account and video. Decrypt said they had not been independently verified, and Ledger’s latest update still says all confirmed cases involve CryptoBilis. Treat the European angle as an open question, not an established widening of the attack, and watch Ledger’s official channels for its findings.
Why this matters beyond one reseller
Self-custody is often described as “not your keys, not your coins.” This incident adds a second clause: your keys are only as safe as the path your device took to reach you. A physical implant inserted somewhere between the factory and the buyer turns the device’s main security feature, generating a secret on a trusted screen, into the very thing that leaks it.
Ledger said it is reminding authorized resellers to source products only through authorized channels and “never to restock returned products,” that it is reviewing reseller controls, and that it wants industry cooperation on supply-chain and anti-tamper practices (Decrypt). How it tightens distribution, and whether other wallet makers follow, is the policy story to watch.
A practical checklist for hardware wallet users
If you bought a Ledger from CryptoBilis in the past three months, follow Ledger’s published guidance: don’t set up an unused device, and if you already did, move funds to a new recovery phrase generated on a device bought directly from Ledger.
For everyone else, these habits reduce the risk of a tampered device:
- Buy direct where you can. Purchase from the manufacturer’s own store, or confirm a reseller on the maker’s official list at the time you buy.
- Avoid second-hand and marketplace devices. If you can’t account for who handled the box, assume the recovery phrase could be exposed.
- Generate your own seed. Never use a device that arrives with a recovery phrase already printed, written down or “pre-configured.”
- Run the authenticity check, but know its limits. It confirms the secure chip, not the absence of extra hardware.
- Inspect packaging and the device. Damaged seals, loose casing or unusual weight are reasons to stop and contact support.
- Beware of follow-up scams. Ledger says it “will never call you, DM you, or ask for your 24-word recovery phrase.” Use only official support channels.
The bottom line
What is confirmed: one implant found by Ledger, a reseller that has stopped selling, and investigator estimates of roughly $72 million to $93 million drained. What is not confirmed: the total, the number of tampered units, and whether European stock is affected. The lesson for holders is the same either way: treat the supply chain as part of your security setup, not an afterthought.
This article is for informational purposes only and is not financial or security advice. Always follow your wallet manufacturer’s official guidance and do your own research.