Ledger confirms implant in CryptoBilis-sold device

Ledger’s investigation into reports of missing crypto from devices bought through Southeast Asian reseller CryptoBilis has confirmed an unauthorized hardware implant in one affected user’s device, the company said Oct. 10.

The finding confirms physical tampering in at least one device, while Ledger says its own systems and direct sales channels remain unaffected.

What has Ledger confirmed about the affected devices?

In its report on Ledger’s updates, CoinDesk quoted the company’s Oct. 10 statement confirming the implant and saying it was contacting affected users as the investigation continued. In an Oct. 11 follow-up, Ledger said all confirmed cases connected to the Oct. 9 draining incident involved devices sold through CryptoBilis, and that the number of impacted devices appeared limited.

Ledger has not publicly detailed the implant’s design or explained how it may have been used. The company has also not confirmed that the implant caused the reported losses, how many customers are affected, or the total value lost. Those limits leave the confirmed hardware finding distinct from the broader reports of drained wallets.

What is known about the reported losses?

Ledger began investigating after users reported missing funds from devices purchased through CryptoBilis. CoinDesk reported that on-chain researchers estimated losses of $86 million to $93 million across more than 300 wallets on multiple blockchains, including Bitcoin, Ethereum and Tron. Ledger has not confirmed those figures or issued an official loss estimate.

Ledger said it had no indication that its security infrastructure, systems or services were compromised. Its updates instead associate the confirmed cases with devices distributed through the reseller. CryptoBilis suspended sales of its hardware-wallet inventory while the investigation proceeds, according to Ledger.

What guidance has Ledger given CryptoBilis customers?

Ledger advises customers who bought through CryptoBilis not to initialize an unused device. Those who have already set one up should consider moving assets to a new Ledger signer using a new seed, the company said. Ledger also urged customers to contact support through its official channels.

Cointelegraph’s report on the confirmation said Ledger was in active communication with CryptoBilis and cooperating with authorities. Ledger asked anyone with information about the investigation to contact its bounty program. It also warned customers that the company will not ask for their 24-word recovery phrase, as scammers may exploit the incident to target users.

Sources

• report on Ledger’s updates — coindesk.com
• Cointelegraph’s report on the confirmation — cointelegraph.com