Ledger has confirmed that a hardware wallet sold through the Southeast Asian reseller CryptoBilis had an extra component added to it, after customers in the region reported their funds had been drained. The case shows that interfering with security hardware between the factory and the buyer is a practical attack, and UK buyers of security kit should treat it as one.
What happened
On Friday 9 October 2026, Ledger said it was investigating reports that customers who had bought its hardware wallets through CryptoBilis had lost cryptocurrency. CryptoBilis is a reseller covering Indonesia, Malaysia and the Philippines. The next day, Ledger Support confirmed that one affected user’s device contained an unauthorised hardware implant. CryptoBilis has since stopped selling all its hardware wallet stock while the investigation runs.
In an update on 11 October, Ledger said a limited number of devices appeared to be affected. It said every confirmed case linked to the 9 October draining was a device sold through CryptoBilis, and that it had found nothing to suggest its own systems or direct sales channels had been compromised. It is working with the authorities and has thanked the SEAL 911 security group for its help.
Ledger has not given an official figure for the losses. The pseudonymous blockchain investigator Specter put them above $86 million. CoinDesk, citing on-chain researchers, reported estimates of $86 million to $93 million taken from more than 300 wallets on Bitcoin, Ethereum and Tron. Neither figure is independently confirmed, and Ledger has not said whether the implant explains every theft.
Binance co-founder Changpeng Zhao claimed on X that the attackers had bought the reseller. That claim has not been independently verified, and CryptoBilis did not immediately respond to CoinDesk’s request for comment.
The technical picture
A hardware wallet is designed so that a computer full of malware still cannot reach the private keys. The keys are generated and kept on a dedicated secure chip. The recovery phrase, usually 24 words, is shown only on the device’s own screen so the owner can write it down.
That is why the implant matters. Someone who adds hardware does not have to break the secure element. They only need to read what the user is shown once, at setup. The recovery phrase is a full backup of the wallet, so anyone who copies it can rebuild the wallet on another device and move the funds whenever they choose.
How the CryptoBilis implant worked has not been officially explained. Security researcher Mark Karpelès has described suspected implants that watch the wallet’s display during setup and send the recovery phrase out over a mobile data connection. Reported parts include an add-on board with a microcontroller, LTE chip, eSIM and antenna. These are his observations, not findings Ledger has published. Ledger has confirmed one implant only. It has not said where in the distribution chain the tampering happened, or who did it.
An unverified social media post claimed a tampered unit was also found via a European authorised seller, without losses. Ledger has not confirmed it, and nothing so far shows the incident extends beyond CryptoBilis.
Why it matters for UK organisations
Few UK businesses keep large balances on consumer hardware wallets. Many more rely on small, sealed security devices trusted because of their origin: FIDO2 security keys, smartcard readers, hardware tokens, USB encryption drives, network appliances and the out-of-band management kit that sits next to them. The attack here is not specific to cryptocurrency. It takes a device whose security depends on a trusted display or a trusted chip, and adds a component that leaks what passes through it.
Procurement is the weak point. Security hardware often comes through marketplaces, distributors’ returns stock and resellers chosen because they are quick or cheap. Ledger’s own response makes the point. It has told distributors to buy only through authorised channels and never to put returned products back on sale. It has also warned that unauthorised sellers carry a real risk of counterfeit or modified devices. UK buyers of hardware protecting keys, credentials or privileged access should ask whether their own process would catch this.
There is also a quieter risk: the device works normally until the attacker acts, so responders only examine the hardware once money or access has gone.
Expert view
Supply-chain interdiction has long been seen as a nation-state capability, rarely met in commercial crime. This case, if the researcher accounts hold up, suggests criminals now find it worthwhile to modify hardware passing through a reseller, although Ledger says the number of affected devices is limited. If the implants do carry a cellular modem and eSIM, that matters because the device would not need the victim’s network to send anything out, so corporate network monitoring would see nothing.
In my experience, physical supply-chain checks are the area organisations skip most often when we scope assessments. They pay for application and infrastructure testing, and the question of who handled a box before it arrived never comes up. When we have done hardware assurance work, the useful checks have been dull ones: verified purchase paths, tamper-evident packaging checked by someone trained to check it, weighing and imaging sample units, and comparing the inside against a known-good reference. None of it is exotic.
The wider rule is simple: any secret shown to a person can be captured on its way to them. Designs that never display the long-term secret, or that tie set-up to vendor attestation, blunt this kind of implant.
What to do now
- Anyone who bought from CryptoBilis: follow Ledger’s advice. Do not set up unused devices. If a device is already in use, move the assets to a new wallet bought directly from Ledger, with a freshly generated recovery phrase. Do not reuse the old phrase. Report thefts to the police and to official Ledger Support only.
- Restrict where security hardware comes from: buy security keys, tokens and wallets only from the manufacturer or its listed authorised partners. Do not accept refurbished or returned stock for anything that holds keys. This supports the secure configuration and access control themes in Cyber Essentials.
- Check on arrival: inspect packaging and seals, record serial numbers, and use vendor attestation or genuineness checks wherever the device offers them.
- Treat pre-set secrets as hostile: reject any device that arrives with a printed recovery phrase, a PIN already set, or signs it has been initialised.
- Add hardware to supplier assurance: include chain of custody and returns handling in third-party risk questionnaires for resellers and distributors.
- Watch for follow-on scams: warn staff and customers that fake “recovery” services and support impersonators usually follow incidents like this one. Ledger says it will never ask for a recovery phrase.
Bottom line
Ledger has confirmed one tampered device, linked to one reseller, in a theft that may run to tens of millions of dollars. Much of the technical detail is still unconfirmed, but the lesson is already clear: the cryptography on a sealed security device does not protect you if someone has modified the device before it reaches you. UK organisations should apply the same scrutiny to where their hardware comes from as they do to their software suppliers.
Sources
- The Hacker News: Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
- CoinDesk: Ledger says unauthorized implant found in at least one device sold by CryptoBilis
- Cyber Security News: Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis
- CoinMarketCap: Ledger Confirms Hardware Implant Found on Device in CryptoBilis Probe
