Science & Tech · Cybersecurity · 1 day ago
Ledger investigates suspected tampering linked to crypto thefts
Ledger is investigating reports that users in Southeast Asia lost cryptocurrency after buying its wallets through reseller CryptoBilis.
The company has asked the reseller to pause sales and shipments while it looks into what happened.
Photos and videos appear to show a small electronic component hidden inside some wallets, but Ledger has not confirmed that devices were tampered with.
The suspected implant may have captured the recovery phrase shown during setup and sent it to an attacker.
Estimates of stolen crypto differ: one account put losses above $86 million, while another tracked about $71.5 million in flagged addresses.
Ledger says it has no indication that its own systems or services were compromised, and the issue appears limited to devices sold through the reseller.
Ledger has advised some customers not to set up affected devices and to consider moving funds to a new wallet with a new recovery phrase.
Ledger is investigating reports that users in Southeast Asia lost crypto after buying devices from reseller CryptoBilis.
Ledger asked the reseller to pause sales and shipments while the investigation is underway.
A suspected hardware implant may have captured wallet seed phrases, but the tampering has not been confirmed.
The Verge reported more than $86 million in crypto stolen from hundreds of wallets, while Gizmodo cited about $71.5 million still held in flagged addresses.
Ledger said it had no indication that its security systems or services were compromised.
- Who
- Ledger is investigating reports involving its users and devices sold through CryptoBilis.
- What
- Users reported lost crypto; a hardware implant is suspected but has not been confirmed.
- When
- Ledger said on October 9, 2026, that it was investigating.
- Where
- The reports involve users in Southeast Asia and devices sold through CryptoBilis, which Ledger lists for Indonesia, Malaysia, and the Philippines.
- Why
- The suspected implant may have captured seed phrases shown during wallet setup, allowing attackers to access funds.
This story does not have two clearly opposing sides.
We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet.
Based on the information available so far, we believe the funds drained are limited to devices sold through a reseller named CryptoBilis in South East Asia.
My spy-implanted ledger came from Malaysia, and had flawless shrink wrap.
Ledger disclosed that payment processor Global-e had exposed names and contact details of an undisclosed number of Ledger.com buyers.
A musician lost about $424,000 in bitcoin after downloading a fake Ledger Live app from Apple’s Mac App Store.
Ledger said it was investigating reports of lost funds and had asked CryptoBilis to pause sales and shipments.
The Verge reported suspicion that a spy implant in some Ledger wallets was linked to crypto thefts.
- Reported crypto stolen
- More than $86 million, according to The Verge
- Flagged-address balance
- About $71.5 million, according to Arkham Intelligence figures cited by Gizmodo
- Reseller
- CryptoBilis
- Markets listed by Ledger
- Indonesia, Malaysia, and the Philippines
- Suspected implant
- A circuit board allegedly hidden under the wallet screen
Sources
Related news
AI security patches often stop crashes but fail maintainers’ tests
Phone settings can help block spam calls and scam texts
Yandex services disrupted after Ukrainian drone strikes on Russian data centers
US seizes two China-linked hacking tools used against critical infrastructure
Dropbox launches data access governance tool in Singapore
Anthropic offers free AI vulnerability scans to open-source projects
FBI arrests another suspect linked to ShinyHunters jobs-site breach
Canadian cybersecurity negotiator arrested in ShinyHunters investigation
Canadian cybersecurity executive arrested on extortion-related charges
Canadian cybersecurity executive arrested in U.S. hacking case
New characters let lookalike domains bypass some browser checks
