Blockchain investigator Specter estimates that $86 million has been drained from Ledger devices, after the Paris-based hardware wallet manufacturer confirmed on Saturday that one affected user's device contained an unauthorized hardware implant. Ledger is now working with relevant authorities.

The company opened its investigation on Friday after customers in Southeast Asia reported losing funds following purchases from a reseller. The vendor has since been identified on social media and in reports as Kuala Lumpur-based CryptoBilis. Ledger has advised customers who bought devices through CryptoBilis not to set them up.

"As the investigation continues, we are working with relevant authorities," Ledger wrote in its Sunday announcement, adding that it had already reached out to affected customers. The company described the number of impacted products as "limited" but did not confirm the total value lost.

Ledger also used the statement to press its long-standing channel-security message: "We strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under Ledger security guidelines."

What did the implant actually do?

Social media users posted photographic evidence of implants embedded inside Ledger devices, claiming the modifications could capture users' private keys. It remains unclear how many units contained the hardware. The mechanism matters here: an implant that exfiltrates seed material defeats the device at the physical layer, before firmware or the secure element ever enter the equation. That distinction explains why Ledger framed the incident as a distribution failure rather than a product vulnerability.

CryptoBilis has stopped selling hardware wallets, Ledger said on Sunday. Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine. For users holding devices bought through unofficial channels, the practical question is straightforward: what does this change for them? The answer is that the only reliable mitigation is to treat any reseller-sourced device as untrusted hardware and migrate funds to a wallet purchased directly from the manufacturer.

"Security isn't static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes," Ledger wrote.

The $86 million figure attributed to Specter would rank the incident among the larger hardware-wallet compromises on record. For context, it approaches the roughly $120 million in bitcoin stolen from Coldcard users in July, when hackers exploited a firmware bug in devices made by Canadian firm Coinkite that caused faulty seed generation — effectively letting attackers guess victims' seed phrases.

A pattern of channel and vendor failures

The Ledger case is the third significant hardware-wallet security event this year, and the three incidents fail in different places. Coldcard's July breach was a firmware defect in seed generation. Trezor reported last month that close to 81,000 customers had personal details leaked after a third-party fulfillment partner suffered a data theft. Scammers have separately obtained Ledger customer information through the company's payment processor, Global-e, and used it to send phishing emails.

For custody practitioners, the pattern carries a clear operational lesson: the attack surface now spans the entire supply chain, from factory firmware through fulfillment partners, payment processors and retail resellers. Verifying provenance of the physical device has become as consequential as verifying the software that runs on it.

Ledger has not disclosed a timeline for the conclusion of its investigation or named the authorities involved. The company's stated review of distribution and anti-tamper processes will determine whether unauthorized reseller channels face formal delisting — the market-structure change practitioners should watch for in the coming weeks.