Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device

What happened

Ledger confirmed that unauthorized hardware implants were found in some of its wallets sold by Southeast Asian reseller CryptoBilis, after users in the region reported losing funds last week. The implants, discovered by Ledger's security research team Ledger Donjon, captured users' 24-word recovery phrases displayed during device setup and transmitted the data over LTE cellular networks using an embedded SIM. The malicious components did not compromise the devices' security chips or alter transaction approvals, Ledger said.

The incident first surfaced on Friday, when crypto users reported losses tied to Ledger devices purchased from CryptoBilis, an authorized reseller listed in Indonesia, Malaysia and the Philippines. Ledger confirmed on Saturday that one affected device contained an unauthorized implant, and said it is examining reports of tampered devices beyond the CryptoBilis supply chain. The company has sold more than 8 million hardware wallets to date, and urged customers who suspect tampering to contact support and file a police report.

Other hardware wallet makers quickly distanced themselves from CryptoBilis. Trezor said it found no indication its products sold through the reseller were affected, but removed CryptoBilis from its authorized reseller network. OneKey reported no related user losses, terminated CryptoBilis' reseller authorization, suspended onboarding new resellers, and began reviewing its existing distribution network. The company also offered free replacements for OneKey devices purchased from CryptoBilis between March 1 and Oct. 12, 2026.

Why it matters

The incident highlights ongoing supply chain risks for hardware wallet users, even as the devices are designed to keep private keys offline. While Ledger says the number of impacted devices is limited, estimated losses from the incident range from $86 million to $103 million, per blockchain investigator Specter and cybersecurity outlet Yfarmx. Ledger has not confirmed the total loss amount, and is working with relevant authorities on the ongoing investigation. The event follows recent high-profile hardware wallet security issues, including a July firmware bug in Coldcard devices that led to roughly $120 million in stolen BTC and a Trezor customer data leak affecting close to 81,000 users earlier this year.

What is still unclear

• The exact number of impacted Ledger devices remains unknown, as the company has not released a full count of affected units.
• It is unconfirmed whether implants found in Ledger devices purchased at European MediaMarkt stores are connected to the CryptoBilis incident.

Questions readers ask