Science & Tech · Cybersecurity · 3 hrs ago
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Ledger says a cryptocurrency wallet sold through Malaysia-based reseller CryptoBilis contained an unauthorized hardware implant.
The company linked all confirmed reports of unexpected fund losses to devices sold through the reseller, but said the number affected was limited.
A hardware wallet is a physical device that stores the private keys used to control cryptocurrency and approve transactions.
Researchers say an implant found in some Ledger X devices could capture screen output and button presses to obtain a recovery phrase and send it to an attacker.
Ledger has not publicly confirmed the implant’s exact design or how and when the devices were tampered with.
It advises buyers who have not set up their device not to do so, and users who have set one up to consider moving their assets to a new device with a new recovery phrase.
CryptoBilis has stopped selling its hardware wallet inventory while the investigation continues, and Ledger says it is contacting affected users and working with authorities.
Ledger confirmed that a device sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant.
The company said all confirmed reports of unexpected fund drains involved devices sold through CryptoBilis.
Ledger described the number of affected devices as limited and said it was contacting impacted users.
CryptoBilis stopped selling its hardware wallet inventory while the investigation continues.
A pseudonymous blockchain investigator said the incident caused losses of more than $86 million.
- Who
- Ledger and CryptoBilis are involved; Ledger says users who bought devices through the reseller were affected.
- What
- Ledger confirmed an unauthorized hardware implant in an impacted device and linked all confirmed fund-drain reports to CryptoBilis-sold devices.
- When
- Ledger began investigating on October 9, 2026, and issued a follow-up update on October 11.
- Where
- The devices were sold through CryptoBilis, a Malaysia-based retailer operating across Southeast Asia.
- Why
- The implant was used to steal cryptocurrency, according to researchers; how and when the devices were tampered with remains unclear.
This story does not have two clearly opposing sides.
Researchers had shown an implant in Ledger X devices.
Ledger said it had opened an investigation into reports of cryptocurrency losses and asked CryptoBilis to stop selling and shipping Ledger devices.
Ledger confirmed hardware tampering on at least one device.
Ledger said all confirmed cases involved devices sold through CryptoBilis and described the affected volume as limited.
- Affected reseller
- CryptoBilis
- Confirmed implant
- At least one impacted device contained an unauthorized hardware implant
- Confirmed cases
- All involved devices sold through CryptoBilis
- Affected volume
- Described by Ledger as limited
- Reported losses
- More than $86 million, according to pseudonymous blockchain investigator Specter
What people are saying
Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation,
We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet,
Your recovery phrase must be generated by your device when you set it up, and written down by you.
Ledger Nano X are used to store crypto. The spy implants are used to steal whatever crypto you store in those Ledger Nano X
Posts on X
Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to
72 hour update on reseller CryptoBilis incident 🔽 As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Malware incident at contractor may expose 8.7 million karaoke records
Critical SonicWall flaw faces exploitation days after patch
Canadian cybersecurity executive arrested on federal extortion charges
Identity systems are a key part of cyber recovery planning
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Pentagon data breach affected more than 3 million people
Cyberattack disrupts refrigeration systems at French supermarkets
Albert Heijn systems remain offline after cybersecurity incident
Attacks disrupt Yandex services and its data centers in Russia
Ricardo users receive phishing messages after data leak
