Ledger confirmed that during an investigation on October 10 into allegations of theft involving Southeast Asian distributor CryptoBilis, the company discovered an unauthorized hardware implant in an affected customer’s cryptocurrency wallet. Blockchain researchers estimate the suspected losses exceed $86 million.
- Ledger confirmed that unauthorized hardware implants were found on affected customers' devices during the investigation into CryptoBilis.
- During Ledger's investigation into reported losses involving Asian customers, CryptoBilis suspended all hardware wallet sales.
- Ledger advises customers who own CryptoBilis devices not to initialize them and recommends that other users use a new recovery phrase.
- Researcher Mark Karpelès reported that he discovered suspicious electronic components behind the screen of a Ledger Nano X in Malaysia.
- Bitquery estimates that cryptocurrency losses across 311 wallets total $92.9 million, but this figure has not been independently verified by Ledger.
Ledger Support confirmed this finding in an official statement, stating that the modified device belonged to a user affected by an ongoing investigation. The company said that, as a precaution, CryptoBilis has halted sales of all hardware wallets, and Ledger is contacting affected customers and cooperating with relevant authorities. It has not yet been determined whether the implant led to the reported cryptocurrency losses.
This finding provides direct confirmation that at least one device has been physically tampered with, following prior warnings about suspicious wallets distributed through this dealer.
Ledger has confirmed the presence of unauthorized implants in customer wallets.
During the investigation, Ledger discovered additional electronic components in the wallet of an affected customer.
The company described the component as an "unauthorized hardware implant," but did not disclose the specific device model, how the component was installed, or whether it transmitted any information.
According to Ledger's statement on October 10, its security team is reviewing the incident and contacting customers believed to be potentially affected. The manufacturer has not yet confirmed how many wallets may have been similarly altered.
On October 9, customers who purchased Ledger products through CryptoBilis began reporting unauthorized transactions. CryptoBilis is a distributor operating in Indonesia, Malaysia, and the Philippines. Upon receiving these complaints, Ledger launched an investigation into the reported losses and requested that the distributor suspend sales and shipping of its devices.
The Block later reported that on-chain investigators initially identified suspected stolen funds exceeding $72 million, while another estimate raised the loss to over $86 million.
Ledger has not verified these figures. The company emphasized in its latest statement that there is no evidence its internal security infrastructure, systems, or services have been compromised.
“We have no indication that Ledger’s security infrastructure, systems, or services have been compromised,” the company said.
The manufacturer is developing additional safeguards to prevent physical tampering with the devices, while investigators continue to determine how unauthorized components entered the affected wallets.
CryptoBilis has suspended all hardware wallet sales during the investigation.
After discovering this issue, Ledger confirmed that it has suspended sales of all its hardware wallet inventory.
This temporary suspension covers all hardware wallet products sold by the distributor, extending beyond the previous measure that required the suspension of Ledger device sales and shipments.
According to TokenPost on October 10, CryptoBilis will remain suspended until the investigation is complete.
Ledger stated that it is maintaining active communication with the distributor regarding the investigation and subsequent actions. Customers who purchased devices through CryptoBilis and have not yet begun setting up their devices are asked not to initiate initialization.
For customers who have previously used these devices, Ledger recommends transferring their cryptocurrency to a new hardware wallet initialized with a completely new recovery phrase. Migrating the existing recovery phrase to a replacement device does not resolve the potential compromise of the phrase by the original hardware.
The company also requested that anyone in possession of relevant evidence provide information, and directed security researchers to its vulnerability bounty program email at [email protected]. Ledger has contacted law enforcement and acknowledged that the Security Alliance’s SEAL_911 incident response program provided assistance.
The company's statement did not identify any suspects, announce any arrests, or provide a timeline for completing the investigation. It was also reported that former CryptoBilis executives Arravind Prabu and Vimalatheethan stated they transferred control of business operations following the ownership change in early 2026.
In a statement shared with researcher Mark Karpelès and published by Tibane Labs, they stated that they completed the management transition in March and no longer control the company’s systems or customer databases.
This statement does not prove who modified the affected devices, nor does it establish any connection between the ownership change and this incident.
Security researchers reported the discovery of hidden electronic components behind Ledger's screen.
Before Ledger publicly confirmed the hardware implant, former Mt. Gox CEO Mark Karpelès reported that he inspected a suspicious Ledger Nano X device from Malaysia. On October 9, Karpelès stated that he discovered an additional electronic component hidden behind the device’s display, embedded within the material typically used to protect the screen.
He noted that the packaging appeared undamaged upon arrival, raising the question of whether customers could detect tampered devices through routine visual inspection. In the photos he publicly shared, the component appeared to contain electronic circuitry separate from the wallet’s original hardware.
Karpelès subsequently reviewed this change further and examined images provided by other affected users.
A technical whitepaper released by Tibane Labs describes a device involving a microcontroller, cellular communication hardware, and connections to the display's internal data lines. The analysis suggests that components located at the screen connection point may capture information displayed during wallet setup.
A recovery phrase typically consists of 24 words that allow wallet holders to regain access to their cryptocurrency holdings. If an attacker obtains these words, they may reconstruct the wallet and authorize transactions without the original hardware device.
Researchers believe that an implanted device capable of reading information sent to a display could theoretically capture recovery phrases during wallet initialization.
However, Ledger has not independently confirmed whether this implant executed this function or whether it caused the theft reported.
The company's official announcement confirmed that a compromised device was physically tampered with, but did not determine the technical method used by the attacker to access customer funds. Ledger's previous security research has examined cases involving unauthorized modifications to wallet hardware.
During a 2018 security response, the manufacturer discussed how attackers could modify a wallet after gaining physical access and interfere with its operation using additional electronic components. Previous research involved different attack scenarios and was not linked to the CryptoBilis investigation.
On-chain researchers estimate the suspected stolen amount to be in the millions of dollars.
While investigators examine the affected hardware, blockchain analysis researchers are attempting to calculate the value of cryptocurrency transferred from the suspected victim’s wallet.
According to a Bitquery survey on October 9, approximately $92.9 million has been transferred from 311 wallets on Bitcoin, Ethereum, TRON, BNB Chain, and Polygon.
This estimate exceeds previous reports of suspected losses ranging from $72 million to over $86 million. Bitquery attributes the difference to the inclusion of additional wallets and blockchain networks in its analysis. Researchers noted that the largest portion of the suspected losses involved USDT transactions on TRON, followed by Bitcoin and Ethereum transfers.
The report states that approximately $70.5 million in assets were transferred out of TRON wallets, with an additional $16.8 million in Bitcoin. Bitquery, based on transaction timing and address relationships, believes these activities are consistent with the attacker having compromised multiple wallets.
The research firm identified multiple transactions on the network that occurred close in time and traced where the transferred assets subsequently flowed. Bitquery reported that approximately $10 million in USDT has been frozen in addresses associated with the suspected theft.
It also identifies transactions involving cryptocurrency exchanges and transfers to Tornado Cash, a service used to obscure the transaction history of digital assets. This analysis remains an independent assessment; Ledger has not confirmed Bitquery’s loss estimates, the number of victims, or conclusions about the attackers.
PublicAML's recent on-chain report also described further movements on October 10 related to the suspected stolen Ether, including transfers to Tornado Cash. The analysis estimated that another transfer of 900 ETH entered Tornado Cash, but the researchers' wallet attribution and loss calculations remain independent of Ledger's confirmed findings.
Ledger urges users to protect their recovery phrase.
Ledger’s investigation has prompted warnings about criminals exploiting public concern over the dealer incident to carry out scams. The company advises customers to rely solely on official communication channels for information regarding affected devices, the investigation, and potential security measures. Its public statement also reminds customers that Ledger support personnel will never request your 24-word recovery phrase.
Previous research on fake Ledger websites documented phishing pages attempting to obtain recovery phrases through forged wallet verification requests.
The report, released on October 11, discusses malicious Google ads that direct users to counterfeit Ledger websites and applications. This phishing campaign has not yet been linked to CryptoBilis hardware investigations. In its latest notice, Ledger stated that it is preparing additional measures to make unauthorized physical modifications more difficult to carry out.
The company has not announced a release date for these protections or provided any details regarding hardware redesigns. For customers seeking guidance, Ledger directs them to its official support website, support.ledger.com.
Its security team stated that affected users will continue to receive direct communication during the investigation, and information regarding this incident can be submitted through its bug bounty program.