- Ledger confirmed an unauthorized hardware implant in one affected user’s device purchased via CryptoBilis.
- On-chain estimates put losses at up to $93.2 million across 315 wallets on six chains.
- The company says its own systems remain uncompromised and urged recent buyers to avoid setup or move funds to a new seed.
Hardware wallet maker Ledger has confirmed that one device linked to reported fund losses contained an unauthorized hardware implant, advancing an investigation into a potential supply-chain attack involving its Southeast Asian reseller CryptoBilis.
In a situation update posted on Oct. 10, Ledger Support stated: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” The company said it is reaching out to affected users, working with authorities, and thanked SEAL 911 for support. CryptoBilis has ceased all hardware wallet sales pending the investigation, according to the post.
The probe began after reports of drained wallets among buyers of Ledger devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines. In an initial statement on Oct. 9, Ledger advised users who purchased from the reseller in the last 90 days not to set up unused devices and to consider moving assets to a new Ledger signer with a fresh seed if already initialized. Ledger has repeatedly stated there is no indication its own security infrastructure, systems, or services were compromised.
On-chain investigators have tallied substantial losses. Blockchain data firm Bitquery reported $93.2 million drained from 315 wallets across TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. The majority was USDT on TRON. Tether has frozen about $10 million in USDT related to the incident. Earlier estimates from researchers such as Specter exceeded $86 million, as first detailed by The Block.
The synchronized nature of the drains—such as multiple wallets signing approvals in seconds—suggests a single actor who obtained private keys, consistent with a hardware implant that could capture the recovery phrase during setup and exfiltrate it. Ledger is developing enhanced anti-tampering measures and urges users to rely solely on official channels, noting that it will never ask for a 24-word recovery phrase.
Affected users are advised to contact Ledger support through official channels. The incident highlights ongoing risks in hardware wallet supply chains, even as the company maintains the issue is limited to the specific reseller channel.
