Ledger implant in reseller-sold wallets drained millions
Ledger confirmed one unauthorized hardware implant in a CryptoBilis-sold hardware wallet as reports tied the Southeast Asia reseller incident to roughly $86 million to $93 million in losses. Ledger said its own systems and direct sales channels were not compromised, and it has paused sales through CryptoBilis while it investigates.
The implant was hidden inside the device, beneath the trusted hardware, and appears to have watched the recovery phrase during setup before sending it out over its own radio link. That means the attacker can rebuild the wallet on another device and empty funds later; changing the original device alone does not erase a captured seed phrase.
For buyers and resellers, the exposure sits in the box’s provenance, not in Ledger’s software. If a wallet was bought through a grey-market or unauthorized channel, the trust question now extends to whether the device itself was modified before it ever reached the user.
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets.