Threats · 18h ago
Ledger confirmed one unauthorized hardware implant in a CryptoBilis-sold hardware wallet as reports tied the Southeast Asia reseller incident to roughly $86 million to $93 million in losses. Ledger said its own systems and direct sales channels were not compromised, and it has paused sales through CryptoBilis while it investigates.
The implant was hidden inside the device, beneath the trusted hardware, and appears to have watched the recovery phrase during setup before sending it out over its own radio link. That means the attacker can rebuild the wallet on another device and empty funds later; changing the original device alone does not erase a captured seed phrase.
For buyers and resellers, the exposure sits in the box’s provenance, not in Ledger’s software. If a wallet was bought through a grey-market or unauthorized channel, the trust question now extends to whether the device itself was modified before it ever reached the user.
3 sources covering this story
Ledger confirms spy chip implant behind wallet crypto thefts
Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets.
Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Ledger confirmed an unauthorized hardware implant in one CryptoBilis-sold device amid fund loss reports and paused sales through the reseller.
Hidden implant in Ledger hardware wallets linked to $93M theft - Help Net Security
Ledger wallets compromised: an implant found in a drained device is linked to $93M in thefts from CryptoBilis buyers.
Part of the PlainSec briefing for 2026-10-13