Ledger Confirms a Hardware Implant Was Found Inside a Customer's Wallet
Ledger has confirmed that a device bought from a Southeast Asian reseller contained an unauthorized hardware implant . It is the first physical proof of tampering in a case that has already drained tens of millions of dollars in crypto .
What the numbers actually say
Nobody agrees on the size of the losses yet. Onchain investigator Specter traced more than $86 million across Bitcoin, Ethereum and Tron . Bitquery counts about $92.9 million across 311 wallets on five blockchains .
None of those figures has been confirmed by Ledger, and each uses a different scope — MistTrack lands near $90 million, Arkham showed roughly $71.6 million at one snapshot . Bitquery says about $70.5 million moved out of Tron wallets, with another $16.8 million in Bitcoin, and some funds were routed into Tornado Cash .
The reseller is now offline
CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines . It has stopped selling its entire hardware wallet inventory while the investigation runs .
Ledger says its own infrastructure, systems and services were not compromised, and that the issue looks isolated to this one reseller and its market . The company is working with authorities and thanked security collective SEAL_911 for its help .
What to do if you bought one
Anyone who bought from CryptoBilis in the past 90 days should not set up an unused device . If you already activated one, consider moving your assets to a new signer with a freshly generated recovery phrase .
Watch out for scammers riding the story. Ledger says it will never ask for your 24-word recovery phrase .
Why this still is not the full picture
Ledger has not said how many devices were altered, what the implant actually does, or where in the distribution chain the modification happened . The finding followed reports from former Mt. Gox chief Mark Karpeles, who said he found suspicious components behind the screen of a Ledger Nano X in Malaysia .
Karpeles claimed the modified unit still passed Ledger's Genuine Check, a detail the company has not confirmed . One confirmed implant also does not prove it caused every reported loss .
For anyone who holds their own keys, the takeaway is uncomfortable. A hardware wallet only protects you if the box that arrived is the box the manufacturer built.