Ledger has confirmed that at least one hardware wallet device linked to recent user fund losses contained an unauthorized hardware implant, marking the first concrete evidence of possible supply-chain tampering in the incident. The company said all confirmed cases identified so far involve devices distributed through Southeast Asian reseller CryptoBilis.
In a statement released on October 10, Ledger Support said one affected user’s device was found to contain an unauthorized hardware implant. The company added that it is contacting impacted users as part of an ongoing investigation, while CryptoBilis has suspended sales of all hardware wallet inventory until the review is completed.
Ledger later stated that the number of affected devices appears limited. According to the company, all confirmed cases connected to the October 9, 2026 fund-draining incident involved devices sold through CryptoBilis, while Ledger’s internal systems and direct sales channels remain unaffected.
The confirmation of a physical implant changes the nature of the investigation, moving the focus from potential software vulnerabilities toward supply-chain security risks. Hardware wallets are designed to keep private keys isolated from online systems, making physical integrity of devices a critical component of their security model.
The incident initially emerged after Ledger received reports of missing funds from customers who purchased devices through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. While Ledger has not confirmed an official total loss, third-party blockchain researchers have estimated losses between $86 million and $93 million across more than 300 wallets on multiple networks, including Bitcoin, Ethereum, and Tron.
Ledger emphasized that there is currently no indication that its internal infrastructure, systems, or services were compromised. The company said it is cooperating with relevant authorities and reminded distributors to source products only through authorized channels while preventing returned devices from being restocked.
For customers who purchased devices through CryptoBilis, Ledger advised against initializing unused devices. Users who have already configured affected devices were instructed to move funds to a new wallet created on a trusted Ledger device. The company also warned users about potential scams following the incident, reminding customers that Ledger will never request a 24-word recovery phrase through calls, messages, or direct contact.
The incident highlights broader concerns around hardware wallet security as more cryptocurrency users move toward self-custody solutions. Since the collapse of major centralized platforms such as FTX, many investors have increased reliance on physical wallets to protect digital assets outside exchange environments.
The key issue moving forward will be whether the investigation identifies the full scope of affected devices and what additional supply-chain protections manufacturers and distributors introduce to prevent similar incidents.
