Ledger says unauthorized implant found in at least one device sold by CryptoBilis
Reported by CoinDesk · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
Ledger confirmed that at least one hardware wallet sold by the Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant linked to recent cryptocurrency thefts. Ledger stated that all known impacted devices come from CryptoBilis, and their own internal systems and direct sales channels were not compromised. Third-party researchers estimate $86 million to $93 million was stolen from over 300 wallets.
Why it matters
The incident confirms physical supply-chain tampering as a real threat to hardware wallet security, raising concerns about trust in self-custodial storage solutions. Ledger's response and ongoing investigation highlight challenges in securing hardware distribution and preventing large-scale thefts.
Key context
The theft emerged after Ledger received reports of missing funds from CryptoBilis device buyers. Ledger has suspended CryptoBilis sales and urged affected users to avoid initializing suspected devices or to migrate funds on wallets purchased through official Ledger channels. This follows prior hardware wallet incidents like the July 2026 Coldcard firmware flaw causing major losses, showing hardware security is not infallible.
Key numbers and entities
Ledger, CryptoBilis (Southeast Asian reseller operating in Indonesia, Malaysia, Philippines), on-chain researchers, Binance co-founder Changpeng Zhao (CZ), Coldcard wallet maker. Estimated stolen amount: $86 million to $93 million from 300+ wallets.
What remains unclear
Exact methods and timing of the hardware implant insertion, any involvement or knowledge by CryptoBilis, and independent verification of claims such as CZ's allegation that the attackers acquired the reseller and imposed NDAs remain unestablished. The full scope and final outcomes of the investigation are pending.