Ledger Discovers Unauthorized Hardware Implant in CryptoBilis Wallet as Reports of Stolen Crypto Funds Emerge

Cryptocurrency hardware wallet company Ledger has temporarily suspended sales through reseller CryptoBilis after reports emerged that customers had lost funds linked to devices purchased from the seller.

On Friday, Ledger confirmed that it was investigating reports of cryptocurrency losses affecting users in Southeast Asia who had bought devices from CryptoBilis. According to pseudonymous blockchain investigator Specter, the incident has reportedly caused losses exceeding $86 million, raising serious concerns about the safety of hardware wallets sold through third-party resellers.

In response to the reports, Ledger advised customers who had purchased devices from CryptoBilis within the past 90 days to take precautions.

"We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," the company said in a post on X. For users who had already set up their devices, Ledger recommended moving their cryptocurrency to a new Ledger device with a newly generated recovery phrase.

The situation became more concerning when Ledger revealed that one of the affected devices had been found to contain an unauthorized hardware implant. The discovery raised questions about whether some devices had been modified before reaching customers. Ledger said it was contacting affected users while continuing its investigation.

As a precaution, CryptoBilis has also stopped selling its entire hardware wallet inventory until the investigation is complete. Although the full details of the incident remain under investigation, the case highlights the risks customers may face when purchasing security products from sources they cannot fully verify.

CryptoBilis also published a security alert on its website, reminding customers that a wallet's recovery phrase must be generated by the device during the initial setup and written down by the owner.

"Your recovery phrase must be generated by your device when you set it up, and written down by you," the company explained. It warned users to consider their wallets unsafe if a recovery phrase was already printed or written on a card or sheet included with the device, or if anyone else had seen the phrase.

The warning is especially important because a recovery phrase can provide access to the cryptocurrency stored in a wallet. If someone else obtains it, they may be able to steal the funds without needing physical access to the device.

CryptoBilis also reminded customers never to share their recovery phrase or PIN with anyone. Neither Ledger nor CryptoBilis will ask users to provide these sensitive details. The company further warned people to be cautious of individuals claiming they can recover stolen cryptocurrency, as such offers are often scams designed to target victims a second time.

In a follow-up update published on October 11, 2026, Ledger said the incident had affected a "limited" number of devices. The company added that all confirmed cases involved hardware wallets sold through CryptoBilis.

Ledger also urged resellers and distributors to obtain products exclusively through authorized supply channels. It stressed that returned devices should never be placed back into stock, helping reduce the risk of potentially compromised products reaching other customers.

The company further warned users against buying hardware wallets from unauthorized sellers, where the risk of receiving suspicious, counterfeit, or modified devices may be higher.

"Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under Ledger security guidelines," Ledger added.

For cryptocurrency users, this incident is a reminder that protecting digital assets involves more than choosing a trusted wallet brand. The source of the device, its condition when purchased, and the security of the recovery phrase all matter.

Hardware wallets are designed to give people greater control over their cryptocurrency, but that protection can be undermined if a device is tampered with before it reaches its owner. Until the investigation provides more answers, customers who purchased affected devices should follow official security guidance and avoid taking risks with their funds.

The incident also highlights a wider challenge for the cryptocurrency industry: trust is essential, but it must be supported by strong security checks throughout the supply chain. For people who have worked hard to build their digital savings, even the possibility of a compromised wallet is a serious concern.