Ledger confirmed on Oct. 10 that one affected customer device contained an unauthorized hardware implant, marking the first confirmed physical tampering finding in its investigation into theft reports tied to devices sold by Southeast Asian reseller CryptoBilis. Ledger said it was contacting impacted users, while CryptoBilis suspended hardware-wallet sales during the investigation.
Ledger confirms implant; CryptoBilis halts sales
The hardware-wallet maker disclosed the finding in a support update, without specifying how many customers had been affected or explaining how the implant may have been used. Its confirmation is limited to one customer device.
While the review continues, CryptoBilis has suspended hardware-wallet sales, removing the products from sale. Ledger said it was reaching out to impacted users, without providing a timetable for the investigation or further public findings.
Ledger warning to recent buyers
One day earlier, Ledger said it was investigating reports of stolen funds associated with devices sold by CryptoBilis. It asked the reseller to halt sales and shipments and advised recent buyers not to initialize their devices, according to its Oct. 9 statement.
Initializing a hardware wallet generally involves setting it up for use and creating or restoring access to crypto holdings. Ledger's instruction was a precaution directed at recent CryptoBilis purchasers while the company examined the reports.
Reported losses and unresolved attribution
Bitquery's Oct. 11 estimate was $93.2 million drained from 315 wallets across six networks. The blockchain analytics firm also said that only one implanted device had been confirmed and that the broader cause remained unresolved.
CoinDesk reported on Oct. 9 that investigator Specter had traced more than $86 million in suspected losses across Bitcoin, Ethereum and Tron addresses. The report added that neither the reported amount nor a connection to the reseller had been independently verified at that time.
These reported figures should not be treated as a confirmed tally caused by Ledger's single identified implant. The scope and cause of the broader theft reports, including whether they were connected to CryptoBilis, remained unresolved.
