Never lose a customer to a missed message
An AI agent trained on your own business, replying in seconds, in any language, on every channel your customers already use.
Ledger has confirmed that a Ledger hardware wallet implant — an unauthorized component secretly added to a device — was found inside a unit belonging to one user caught up in losses now estimated above $86 million. The device was purchased through CryptoBilis, a Ledger reseller operating across Indonesia, Malaysia and the Philippines, which has suspended sales of its hardware-wallet inventory while the investigation continues.
On-chain investigator Bitquery separately estimated losses closer to $92.9 million spread across 311 wallets on five different blockchains, though that figure comes from a third party and has not been confirmed by Ledger itself. The company stressed that one confirmed implant does not establish that tampering caused every reported loss, and that the full scope of the incident remains under investigation.
How the suspected implant surfaced
Reports of unusual losses tied to CryptoBilis-sourced devices first surfaced around October 9. The story escalated the next day, October 10, when former Mt. Gox chief executive Mark Karpelès posted images of a suspicious chip he said was concealed beneath the screen of a Ledger device he had purchased in Malaysia. Binance founder Changpeng Zhao issued his own warning to Ledger users that same day, amplifying concern before Ledger itself issued a formal update.
Ledger’s October 10 statement confirmed the implant in one affected user’s device, but the company said it has found no indication that its own internal security infrastructure, systems or services were compromised. It has not confirmed whether its broader device supply chain was affected beyond the CryptoBilis channel, and it said it is working with authorities alongside the security-response group SEAL 911, which it thanked for assistance.
What the Ledger hardware wallet implant actually is
A hardware implant, in this context, is a small, concealed electronic component added to a device after manufacturing — physical tampering rather than a software hack. Because it sits inside the hardware itself, it can potentially intercept information a legitimate software update would never touch, which is why Ledger’s advice to affected users focuses on replacing the device entirely rather than simply updating firmware.
Ledger says it is developing additional anti-tampering measures in response, though it has not detailed what those measures will involve or when they will ship.
What Ledger is telling affected customers to do
Ledger’s guidance splits into two groups. Customers who bought a device through CryptoBilis in the 90 days before the warning and have not yet set it up are told not to begin setup at all. Those who already completed setup on such a device are advised to move their crypto holdings to a new Ledger signer using a freshly generated recovery seed, following the company’s official migration instructions rather than any third-party tool.
Ledger has also repeated a standing warning that it will never ask for a user’s 24-word recovery phrase under any circumstance, and that anyone offering “emergency help,” investigation services or fund recovery in exchange for that phrase is attempting a scam layered on top of the original incident.
What Ledger users should do next
Anyone who bought a hardware wallet through CryptoBilis in the past three months should treat the device as potentially compromised regardless of whether they have noticed anything unusual, given that a hardware implant can sit dormant and undetected. Ledger’s official support channels remain the only safe route for assistance — not search-result links, social media replies offering help, or unsolicited messages referencing the case.
Beyond this specific incident, the case is likely to renew scrutiny of hardware-wallet reseller networks generally, since the core vulnerability here was a tampered supply chain rather than a flaw in Ledger’s own design. Other hardware wallet makers selling through third-party resellers in Southeast Asia may face similar questions in the coming weeks.
Ledger implant: what you need to know
How much money has been lost?
Reports cite more than $86 million in losses, with on-chain investigator Bitquery estimating closer to $92.9 million across 311 wallets — figures Ledger has not independently confirmed in full.
Which reseller is involved?
CryptoBilis, which sells Ledger devices in Indonesia, Malaysia and the Philippines and has paused sales of its hardware-wallet stock.
Was Ledger’s own system hacked?
Ledger says it has no indication its internal infrastructure or services were compromised; the issue traces to physical tampering of devices sold through one reseller.
What should I do if I bought through CryptoBilis?
If you haven’t set up the device, don’t start now. If you already set it up, move your funds to a new Ledger device with a freshly generated recovery seed.
Will Ledger ever ask for my recovery phrase?
No. Ledger says it will never ask for your 24-word phrase, and anyone who does is attempting a scam.
Is the investigation finished?
No. Ledger describes the probe as ongoing and has not yet confirmed the full scope of affected devices.
Sources
- The Crypto Times — Ledger Confirms Hardware Implant Amid $86M Loss Probe, Urges Users to Re-Seed. cryptotimes.io
- KuCoin News — Ledger Confirms Unauthorized Hardware Implants in Wallets, Involving $92M in Reported Losses. kucoin.com
For related coverage, see our reports on the NoOnes shutdown and frozen user funds and the Revolut data breach.
Verification your users actually receive.
Send one-time passcodes over WhatsApp with a single API call. Replio can generate, hash and verify the code for you.
