The company says a covert implant was discovered in devices sold through a third-party reseller, amid reports of roughly $92 million to $93 million in stolen funds.
Hardware wallet maker Ledger says it has uncovered a hidden chip embedded inside devices sold through an outside reseller. The company identified the seller as CryptoBilis, according to reports describing the findings. The implant was reportedly discovered during an investigation into tampered units that reached customers outside Ledger's official sales channels.
Ledger builds devices meant to keep private keys offline and isolated from internet-connected systems. That design is the core selling point for hardware wallets generally. A hidden component inside the casing could undermine that isolation, potentially giving an attacker a way to access or exfiltrate sensitive key material without the owner's knowledge.
Reports describing the discovery link the tampered wallets to a broader pattern of crypto theft. Estimated losses tied to the incident vary by source, with figures cited at either $92 million or $93 million. The discrepancy has not been resolved publicly, and it remains unclear whether the different figures reflect separate loss tallies or simple rounding across reports.
Ledger has built its reputation on secure-element chips and firmware verification designed to detect tampering before a device reaches a customer. The company has long warned buyers to purchase directly from Ledger or its authorized partners, rather than from third-party marketplaces or resellers of uncertain provenance. This case appears to center on exactly that risk: a reseller distributing units that had been altered before sale.
Supply-chain tampering is a known threat in the hardware security industry, not unique to crypto wallets. Attackers can intercept products in transit, modify internals, then reseal packaging to appear unopened. Security researchers have previously demonstrated proof-of-concept attacks along these lines against hardware wallets, though confirmed real-world cases with substantial financial losses are less common.
Ledger has not detailed the full scope of affected units or the exact mechanism by which the alleged chip could extract funds. The company's investigation into the matter is described as ongoing across the reports covering the story. Additional technical details, including how the implant operated and how many devices were affected, may emerge as the probe continues.
Market Impact
News of a hardware implant inside wallets tied to a reseller is likely to renew scrutiny of hardware wallet supply chains across the industry. Buyers may face pressure to verify purchase channels more carefully, and demand for direct-from-manufacturer sales could increase if the findings are confirmed in full.
The reported loss figures, whether $92 million or $93 million, underscore the scale of damage attributed to the incident. If losses of that magnitude are verified, the case could become a reference point for how custody providers and wallet makers communicate supply-chain risk to retail users going forward.
Ledger's investigation into the tampered wallets remains active, and further details on the scope of losses and affected devices are expected as the inquiry progresses.
Frequently Asked Questions
What did Ledger discover during its investigation?
Ledger says it found a hidden chip implanted inside hardware wallets that had been sold through a third-party reseller identified as CryptoBilis.
How much money has reportedly been lost in connection with the tampered wallets?
Reports cite losses of either $92 million or $93 million, with sources differing on the exact figure.
Were the tampered devices sold directly by Ledger?
No. The devices were reportedly sold through an outside reseller rather than Ledger's official sales channels.
How could a hidden chip compromise a hardware wallet?
Hardware wallets are designed to keep private keys isolated offline. An unauthorized implant could potentially undermine that isolation, though Ledger has not detailed the exact mechanism.
Is the investigation finished?
No. Reports describe Ledger's probe into the tampered devices and related losses as ongoing.