Ledger has confirmed that a device linked to a wave of cryptocurrency thefts contained an unauthorized hardware implant, and that every confirmed case to date involves wallets sold through the Southeast Asian reseller CryptoBilis. On-chain researchers estimate losses of $86 million to $93 million across more than 300 wallets on Bitcoin, Ethereum and Tron.

In a statement released Oct. 10, Ledger Support said: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The company said it is actively contacting affected users as part of an ongoing investigation, and that CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes.

The confirmation of a physical implant provides the first concrete evidence for earlier speculation of supply-chain tampering in the incident, which first surfaced Friday when Ledger acknowledged it was investigating reports of missing funds from customers who bought devices through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines.

In a follow-up update on Oct. 11, Ledger said the number of impacted devices appears limited. "To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis," the company stated. Ledger reiterated that it has no indication its internal security infrastructure, systems or services were compromised, and that its direct sales channels remain unaffected.

What should affected customers do now?

Ledger repeated its security guidance for customers who purchased devices through CryptoBilis:

• Do not initialize unused devices.
• If a device is already set up, move funds to a new seed on a device obtained directly from Ledger.
• Contact official Ledger Support and file complaints with local law enforcement.

The company also warned that scammers frequently exploit incidents of this type, and said it will never call, DM or ask users for their 24-word recovery phrase.

Ledger said it is cooperating with relevant authorities as of Sunday. It has also reminded its distributor network to source products exclusively through authorized channels and has strictly prohibited restocking of returned products.

How was the supply chain breached?

Speculation around the breach mechanism continues to circulate. In a post on X, Binance co-founder Changpeng Zhao alleged that the attackers "apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut." Those claims have not been independently verified, and CryptoBilis did not immediately respond to requests for comment on the incident or Zhao's specific allegations.

For Ledger, the operational consequences extend beyond this incident. "Security isn't static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes," the company said in its Oct. 11 post. Ledger added that it is reviewing authorized reseller controls, advancing hardware protections and calling for broader industry improvements in chain-of-custody practices.

Is hardware self-custody still safe?

The incident has revived industry questions about hardware wallet security. Since the 2022 collapse of the FTX exchange, millions of investors have moved assets into self-custody, relying on physical devices from manufacturers such as Ledger and Coinkite, maker of Coldcard, to keep private keys offline. Physical storage, however, has not proven immune.

In July 2026, a flaw in Coldcard's seed-generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers.

Ledger maintains that the physical tampering in the current case is strictly isolated to the batch distributed by CryptoBilis. With the investigation ongoing, CryptoBilis sales suspended and authorities now involved, the near-term focus falls on whether Ledger's reseller control review forces structural changes to how hardware wallets move from factory to customer.