Seven days after opening its investigation into a Southeast Asian reseller, Ledger has confirmed the uncomfortable part: at least one device sold through CryptoBilis carried an unauthorized hardware implant, and the estimated toll of the resulting drains has swelled to $86 million–$93 million across more than 300 wallets. The Ledger hardware implant finding is the sort of news that makes hardware-wallet owners glance sideways at the shrink wrap still sitting in the drawer.
What the Ledger hardware implant actually does
According to published reporting on the incident, the implant is a slim hidden circuit board mounted behind the device’s screen, carrying a microcontroller, an antenna and an LTE chip with an e-SIM. Its job is grimly simple: capture the recovery seed phrase as the user displays it on screen, then transmit it to whoever is listening on the other end of that cellular link.
The clever part — and the reason this went unnoticed for so long — is that the device’s genuine secure element is untouched. The tampered units still pass Ledger’s Genuine Check, and packaging arrives factory-intact. The attack lives in the gap between an authentic device and an authentic supply chain.
Who is affected and what Ledger wants you to do
All confirmed cases trace to CryptoBilis, a reseller operating across Indonesia, Malaysia and the Philippines. Ledger has paused all sales through the reseller, asked it to halt shipments, and stressed that its own internal systems and direct-sales channel are not implicated. Around $10 million in USDT has been frozen through Tether and law-enforcement coordination; on-chain researchers say some theft addresses have since moved funds toward Europe.
Owners who bought through CryptoBilis — especially in the last 90 days — should not initialize any device still sitting unused. If a device from that channel is already set up, Ledger’s advice is blunt: move assets to a new device with a brand-new seed phrase. The $86M–$93M loss estimate comes from third-party on-chain researchers such as Bitquery; Ledger has not independently confirmed a total, and the investigation remains open as of October 12.
Direct-from-Ledger buyers can breathe, for now. Everyone else might want to go check where their hardware actually came from.
