Ledger confirms hardware implant in device sold by reseller CryptoBilis
In brief
- Ledger confirmed an unauthorized hardware implant in one affected user's device on Oct. 10.
- CryptoBilis, a reseller, sold the devices in all confirmed cases, according to Ledger.
- On-chain researchers estimate losses at $86M to $93M; Ledger hasn't confirmed a figure.
- Ledger's internal systems and direct sales channels weren't affected, the company says.
What Ledger has confirmed
The incident first surfaced on Friday, when Ledger acknowledged it was investigating reports of missing funds from customers who'd bought devices through CryptoBilis. A day later, Ledger Support went further.
"Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant."
How widespread is it? In an Oct. 11 update, Ledger said the volume of impacted devices appears limited and that all confirmed cases tied to the draining incident disclosed on Oct. 9 involve devices sold through CryptoBilis. The company maintains the physical tampering is isolated to that reseller's batch (and says its internal systems and direct sales channels remain unaffected). It also reiterated there's no indication its own security infrastructure, systems or services were compromised.
According to Ledger, CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes. Ledger said it's contacting affected users and, as of Sunday, is cooperating with relevant authorities.
The loss estimate
Ledger hasn't confirmed an official loss figure.
Third-party on-chain researchers cited by CoinDesk put losses at between $86 million and $93 million, spread across more than 300 wallets on chains including Bitcoin, Ethereum and Tron.
What users are being told
Ledger's guidance to CryptoBilis customers is blunt: don't initialize unused devices, and if one's already set up, move to a new seed on a device from Ledger. The company urged affected users to contact official Ledger Support and file complaints with local law enforcement. It also warned about scammers, noting it will never call, DM, or ask for a 24-word recovery phrase.
On the distribution side, Ledger reminded distributors to source products only through authorized channels and prohibited restocking of returned units. It says it's reviewing authorized reseller controls, advancing hardware protections and calling for industry improvements in chain-of-custody practices.
Ledger isn't the only hardware wallet maker dealing with a breach this year. In July 2026, a flaw in Coldcard's seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers. The stakes have climbed since the 2022 collapse of FTX, when millions of investors moved assets into self-custody (relying on hardware wallets from firms including Ledger and Coinkite).
Frequently asked questions
What should CryptoBilis customers do with their Ledger devices?
Ledger advised CryptoBilis customers not to initialize unused devices. If a device is already set up, the company says to move to a new seed on a device from Ledger. Affected users were urged to contact official Ledger Support and file complaints with local law enforcement.
How much was lost in the Ledger CryptoBilis incident?
Ledger hasn't confirmed an official loss figure. Third-party on-chain researchers estimated losses at between $86 million and $93 million from more than 300 wallets across blockchains including Bitcoin, Ethereum, and Tron.
Were Ledger's own systems compromised?
Ledger says no. The company said its internal systems and direct sales channels remained unaffected, and it reiterated there was no indication its internal security infrastructure, systems, or services were compromised. It maintains the tampering was isolated to the batch distributed by CryptoBilis.
