Ledger is investigating a hardware wallet supply chain attack after confirming that at least one affected device contained an unauthorized physical implant capable of spying on information displayed by the wallet.
The incident has been linked to devices sold through CryptoBilis, a reseller operating in Southeast Asia. Reported cryptocurrency losses have reached at least $86 million, while some estimates place the total above $100 million.
Ledger says all confirmed cases connected to the October 9 draining incident involved devices sold through CryptoBilis. The company says its own systems and direct sales channels have not been affected.
Physical Implant Was Found Inside an Affected Wallet
Unlike many cryptocurrency attacks that rely on malware, phishing or compromised online accounts, this incident appears to involve hardware that was physically modified somewhere in the supply chain.
A disassembled affected device reportedly contained an unauthorized electronic implant hidden inside the wallet.
Images shared during the investigation indicate that internal components had been rearranged to make room for the additional hardware, with the implant positioned near the display.
The modification was reportedly able to capture information associated with what appeared on the wallet's screen while leaving the device's original Secure Element intact.
| Incident detail | Information |
|---|---|
| Company | Ledger |
| Reseller linked to confirmed cases | CryptoBilis |
| Incident date | October 9, 2026 |
| Reported losses | At least $86 million |
| Higher estimate | More than $100 million |
| Attack type | Physical supply chain modification |
| Ledger direct sales | Company says unaffected |
| CryptoBilis sales | Suspended during investigation |
Ledger has confirmed that one affected device contained unauthorized hardware, although the company says the overall number of compromised devices appears limited.
Normal Integrity Checks May Not Detect This Type of Modification
One of the more concerning parts of the incident is that standard device verification may not be enough to detect a sophisticated physical implant.
Ledger says its integrity checks cannot identify unauthorized physical modifications when the original Secure Element remains intact.
That means a wallet could potentially pass normal authenticity checks while still containing additional spying hardware.
The company publishes internal images of its devices that can help technically experienced owners compare components, but the reported implant was apparently difficult to identify even after opening the wallet.
This highlights a different type of risk for hardware wallets.
A genuine cryptographic chip can still be present while another unauthorized component has been added around it.
CryptoBilis Has Stopped Selling Hardware Wallets
Ledger says CryptoBilis has stopped hardware wallet sales while the investigation continues.
The company is also working with authorities and has asked anyone with relevant information to contact its security team.
Ledger says it is reviewing controls for authorized resellers, physical anti tamper protections and supply chain procedures following the incident.
The company is also reminding distributors not to restock returned products and to obtain hardware only through approved channels.
The incident demonstrates that being an authorized reseller does not completely eliminate supply chain risk if hardware is modified before reaching a customer.
Ledger Advises Affected Buyers to Take Immediate Precautions
Ledger has issued specific guidance for customers who bought devices from CryptoBilis.
Unused devices from the reseller should not be initialized.
Anyone who has already configured one should move their cryptocurrency to a new seed created on a replacement device obtained through a trusted Ledger channel.
The company also recommends contacting official support and filing a complaint with local law enforcement if there is reason to believe a wallet was compromised.
Ledger has additionally warned customers that scammers may attempt to exploit confusion surrounding the incident.
The company says it will never call or privately message customers asking for their 24 word recovery phrase.
Supply Chain Security Is Becoming a Bigger Concern
Hardware wallets are generally used because they keep cryptocurrency private keys isolated from internet connected devices.
This incident does not necessarily undermine that security model itself. Instead, it demonstrates what can happen when the hardware reaching a customer has been physically altered before use.
Buying directly from a manufacturer may reduce the number of organizations involved in the supply chain, although no purchasing method can eliminate every possible risk.
For hardware securing large amounts of money, verifying where a device came from and avoiding suspicious, returned or modified products has become increasingly important.
Ledger's investigation remains ongoing, and the company has not yet provided a final number of affected devices or confirmed the full amount stolen.
Discussion (0)
Be the first to comment.