QuantCapLedger confirmed an unauthorized hardware implant in a device linked to crypto losses at CryptoBilis, a Southeast Asian reseller. The company says confirmed cases are limited and its internal systems remain unaffected.
Ledger says unauthorized implant found in at least one device sold by CryptoBilis
Ledger confirmed an unauthorized hardware implant in a device linked to crypto losses at CryptoBilis, a Southeast Asian reseller. The company says confirmed cases are limited and its internal systems remain unaffected.
Ledger confirmed that a device tied to recent cryptocurrency thefts contained an unauthorized hardware implant, with all known cases involving wallets sold by the Southeast Asian reseller CryptoBilis. On-chain researchers estimate that $86 million to $93 million was stolen from more than 300 wallets, though Ledger said its internal systems and direct sales channels were not compromised. Ledger advised CryptoBilis customers not to initialize unused devices and told those with active wallets to move their funds to a new seed on a device obtained directly from Ledger.
Crypto wallet manufacturer Ledger has confirmed that a device linked to recent user fund losses contained an unauthorized hardware implant. According to the company, all confirmed cases identified so far involve products distributed through the Southeast Asian reseller CryptoBilis.
In a statement released on Oct. 10, Ledger Support stated, “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” The company added that it is actively contacting affected users as part of an ongoing investigation, and that CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes.
In a follow-up update on Oct. 11, Ledger noted that the volume of impacted devices appears limited. “To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis,” the company stated, adding that its internal systems and direct sales channels remain unaffected.
The confirmation of a physical implant marks the first concrete evidence supporting earlier speculation of supply-chain tampering.
The incident first came to light on Friday, when Ledger acknowledged investigating reports of missing funds from customers who purchased devices through CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines.
While Ledger has not confirmed an official loss, third-party on-chain researchers have estimated the loss at between $86 million and $93 million from more than 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. The company reiterated that it there is no indicattion that its own internal security infrastructure, systems, or services were compromised.
Ledger stated it is cooperating with relevant authorities on Sunday. The company also reminded its network of distributors to source products exclusively through authorized channels and strictly prohibited the restocking of returned products.
The company repeated its earlier security guidance to pcustomers who purchased devices via CryptoBilis: “Do not initialize unused devices. If already set up, move to a new seed on a device from Ledger.” The company urged affected users to contact official Ledger Support and file complaints with local law enforcement.
Ledger also warned that scammers often attempt to exploit incidents of this type, reminding users that the company will never call, DM, or ask for their 24-word recovery phrase.
When will wallets be SAFU?
The Ledger incident has again raised broader industry questions regarding hardware wallet safety. Following the 2022 collapse of the FTX exchange, millions of investors migrated their assets into self-custody, relying heavily on physical hardware wallets made by firms like Ledger and Coinkite (makers of Coldcard) to keep private keys entirely offline.
In practice, however, physical storage has not been immune to vulnerabilities.
In July 2026, a flaw in Coldcard’s seed-generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to data from on-chain researchers.
In this current exploit, Ledger maintains that the physical tampering is strictly isolated to the batch distributed by CryptoBilis and it is taking necessary steps to avoid such risks.
“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes,” Ledger said in its Oct. 11 post.
It added that it is reviewing authorized reseller controls, advancing hardware protections, and calling for broader industry improvements in chain-of-custody practices.
Still, speculation regarding how the supply chain was breached continues to circulate.
In a post on X, Binance co-founder Changpeng Zhao (CZ) alleged that the attackers “apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut.”
These claims have not been independently verified. CryptoBilis did not immediately respond to requests for comment regarding the incident or Zhao's specific allegations.
1Bitcoin shrugs off ETF outflows to trade above $84,000 as oil falls3 hours ago 2Everyone wants SCOTUS to take up prediction markets: State of Crypto 13 hours ago 3Clarity's failure could speed crypto innovation while shielding incumbents16 hours ago 4President Trump declares 'energy ceasefire' between Russia and Ukraine16 hours ago 5IMF finds demand for tokenized stocks, says the market is still volatile, illiquid19 hours ago 6One year after 10/10 flash crash, bitcoin and ether liquidity have rebuilt, but altcoins still face risks1 day ago 7Tokenized commodities look beyond gold as lending and oil open new markets1 day ago 8Bitcoin's $19 billion wake-up call: One-year after flash crash, has crypto learned anything?1 day ago 9Bitcoin's volatility has plunged, but extreme price swings are more frequent than in 20182 days ago 10Robinhood Chain slowdown spreads from fees to trading as transactions fall more than 40%2 days ago
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Beyond the Risk-Free Rate: Diversified Real World Yield in Productive Stablecoins
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
Why it matters:
Diversified RWA stablecoins sustain 5-7% yield from real credit as crypto funding compresses to ~4%. GENIUS pushes yield off-chain; TAM grows to $4B in 3 years.
XRP Ledger patched decade-old bug that could create billions of dollars in XRP from nothing
Zcash developers set January target for quantum-resistant payments after ‘bunker mode’ scare
Solana is about to halve its block times as final 200-millisecond upgrade nears