Ledger confirmed on October 11 that a Ledger hardware implant was discovered inside at least one wallet sold through a Southeast Asian reseller, as blockchain researchers trace more than $86 million in cryptocurrency losses to a growing list of tampered devices. The admission is the first time the French hardware wallet maker has verified physical tampering tied to the CryptoBilis reseller case, which has unsettled self-custody users since reports surfaced earlier this month.
How the Ledger Hardware Implant Was Found
Images and videos circulating on social media show a small circuit board hidden beneath the screen of one affected device, reportedly built to intercept anything displayed on-screen, including the seed phrase shown during initial setup, and relay it to an attacker through an embedded SIM card. Independent researcher Mark Karpelès said separately that he found a hidden chip inside a Bitcoin-compatible Ledger Nano X capable of reading the seed phrase even from unopened factory packaging. Ledger said its own investigation identified the reseller, CryptoBilis, as the common source of every confirmed case so far, and that it found no evidence its own manufacturing, infrastructure, or services were compromised.
What Ledger Has Confirmed, and What Hasn't Been Verified
The $86 million figure did not come from Ledger itself. Blockchain analytics firm Specter estimated that total across Bitcoin, Ethereum, and Tron addresses it linked to the investigation, while a separate estimate from Bitquery put losses closer to $92.9 million across 311 wallets. The Ledger hardware implant is the clearest physical evidence so far in a case that until now rested mainly on reported loss totals and social media photos. Ledger has confirmed only that one examined device carried a physical implant; it has not verified either loss figure or confirmed that every traced wallet belongs to a CryptoBilis customer. Researchers tracking the case have also warned that wallet-clustering methods can misattribute transactions, and that overlapping transfers between datasets could inflate the real total.
What CryptoBilis Customers Should Do Now
CryptoBilis has stopped selling hardware wallets as a precaution while Ledger works with the reseller and law enforcement to identify every affected unit. Ledger is directly contacting known CryptoBilis customers and has told anyone who bought a device through that reseller not to set it up at all. Separately, it recommended that other Ledger owners generate a fresh recovery phrase rather than reuse one entered on a device of uncertain origin, since a compromised seed phrase exposes every asset tied to it regardless of which wallet software is used afterward.
The case adds to a year in which hardware-supply-chain attacks have moved from a theoretical self-custody risk to a documented one, with regulators and consumer-protection advocates now watching how hardware wallet makers respond. Ledger said it will publish further findings as its investigation continues; owners of any hardware wallet should rely on official channels for updates rather than secondhand reports on social media.