Ledger is investigating reports that tens of millions of dollars in crypto have been drained from customers who bought its hardware wallets through CryptoBilis, an authorised reseller in Southeast Asia — and the company has now confirmed that at least one of the affected devices contained an unauthorised hardware implant.

The implant, described in photos and videos that users posted on X and Threads, is a small circuit board sandwiched between the wallet's screen and its body. According to those reports it captures whatever the screen displays — including the recovery seed phrase a wallet shows once, during initial setup — and uses an embedded SIM card to transmit it to an attacker, who can then restore the wallet on another device and move the funds.

Ledger said it has asked CryptoBilis to pause all sales and shipments while the investigation continues, and it published guidance for users who bought through the reseller in the past 90 days. The company stressed that it has found no sign that its own systems were compromised, and that wallets bought directly from Ledger are not affected. Analysts tracking the theft addresses estimate losses at more than $86 million, spread across several blockchains and hundreds of reported wallet drains.

The incident is a supply-chain case rather than a cryptographic one: Ledger's hardware and firmware appear to have held, but the route that delivered the device did not. That distinction matters because it is the one link users cannot check themselves. A tampered wallet can arrive shrink-wrapped, working, and indistinguishable from a legitimate device — until the seed has already left it.

For hardware-wallet users, the practical response is to treat provenance as part of security. Ledger has published checks for spotting a tampered device, and anyone who cannot be certain where a wallet came from — or who has displayed a seed on a device bought through a third party — should assume the phrase is compromised and move funds to a wallet generated from a fresh seed.

The scale of the loss — an eight-figure sum apparently reached through a single reseller — suggests that trade was made often.

Sources