Ledger confirms implant in CryptoBilis-sold wallet

During an investigation into reported losses among customers of Southeast Asian reseller CryptoBilis, Ledger said on Oct. 10 that one affected user’s device contained an unauthorized hardware implant. CoinDesk’s report on Ledger’s confirmation says the company is contacting affected users and that CryptoBilis has suspended sales of its hardware wallet inventory while the investigation continues.

The finding confirms physical tampering in at least one device, while leaving its role in the reported losses unresolved.

What has Ledger confirmed about the affected devices?

Ledger said on Oct. 11 that all cases it had confirmed in connection with the Oct. 9 draining incident involved devices sold through CryptoBilis, and that the number of impacted devices appeared limited. The company has not publicly identified the device model, explained how the implant was introduced or said what it does.

Ledger also said there was no indication that its internal security infrastructure, systems or services had been compromised. That limits the company’s stated findings to devices distributed through the reseller; it does not establish how the suspected tampering occurred or whether the implant caused any reported loss.

What should CryptoBilis customers do?

Ledger’s guidance depends on whether a device has been initialized. Customers who bought a device through CryptoBilis and have not set it up should not initialize it, the company said. Those who have already set one up should move assets to a new Ledger device using a newly generated seed.

TokenPost’s account of the investigation likewise notes that Ledger has not confirmed the implant caused the reported losses, or how many devices and users may be affected. Ledger advised affected users to contact official support and file a report with local law enforcement. It also warned that scammers may use the incident to solicit recovery phrases; the company says it will not ask users for their 24-word phrase.

How much cryptocurrency was lost?

Ledger has not confirmed an official loss total. CoinDesk reported estimates from third-party on-chain researchers ranging from $86 million to $93 million across more than 300 wallets on multiple blockchains, including Bitcoin, Ethereum and Tron. Those figures are estimates, not a total verified by Ledger, and the company has not tied them to the implant.

The investigation therefore leaves two separate questions open: the extent of any device tampering beyond the confirmed case, and whether that tampering accounts for the reported wallet drains. Ledger said it is cooperating with authorities and reviewing controls for authorized resellers. It has also reminded distributors to source products through authorized channels and not to restock returned devices.

Sources

• CoinDesk’s report on Ledger’s confirmation — coindesk.com
• TokenPost’s account of the investigation — tokenpost.com