PARIS / RankWire.AI / – Ledger has confirmed an unauthorized hardware implant in one customer device linked to cryptocurrency losses involving reseller CryptoBilis. The hardware wallet maker is investigating reports from users in Southeast Asia whose funds disappeared after they bought devices through the reseller. Ledger said every confirmed case tied to the October 9 draining incident involved devices sold through CryptoBilis. The company said its own systems and direct sales channels remain unaffected.
Ledger opened its investigation on October 9 after customers reported losses from wallets purchased through CryptoBilis. It asked the reseller to pause Ledger sales and shipments while the review continued. The company advised people who bought devices there during the previous 90 days not to initialize unused wallets. Customers who had already completed setup were told to move assets to a new Ledger signer using a new recovery seed.
Ledger disclosed the hardware finding on October 10, saying one affected user’s device contained an unauthorized implant. The company has not identified the device model or explained how the added hardware functioned. It has also not said where or when someone altered the device. Ledger said it is contacting impacted users and working with relevant authorities as the investigation continues. Ledger has not confirmed that the implant caused every reported loss.
Confirmed cases center on CryptoBilis
Ledger said in a 72-hour update that the volume of impacted devices remains limited. It added that CryptoBilis had stopped selling all hardware wallets while the investigation proceeds. CryptoBilis served customers in Indonesia, Malaysia and the Philippines and had sold Ledger products in those markets. Ledger also reminded authorized resellers not to place returned devices back into inventory. The company said it was reaching out directly to affected users.
The company has not published an official figure for customer losses or the number of affected devices. Blockchain analytics firm Bitquery said its October 12 analysis counted about $102 million taken from 324 wallets across six blockchain networks. Those networks included TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. Ledger has not confirmed Bitquery’s total or said that every wallet in the estimate involved the same hardware modification.
Loss estimates rise as tracing continues
Bitquery said most of the value in its estimate came from TRON wallets holding USDT, while Bitcoin represented the second-largest portion. Its analysis also found that Tether froze about $10 million in USDT across 20 wallets linked to the tracked transfers. The blockchain data showed additional funds moving through Ethereum and other networks after the October 9 drains. Bitquery said its figures covered money leaving victim wallets and excluded transfers between wallets it associated with the same operator.
Ledger continues to urge affected CryptoBilis customers to follow its device guidance while the investigation remains active. Users with uninitialized devices from the reseller should not begin setup, according to the company. Those who already initialized a device should move assets to a new signer with a newly generated recovery seed. Ledger has also warned customers that support representatives will never ask for a 24-word recovery phrase.