Ledger has confirmed that at least one hardware wallet linked to recent cryptocurrency losses contained an unauthorized physical implant, narrowing the known scope of an incident that on-chain researchers estimate affected more than 300 wallets. All confirmed cases so far involve devices sold by Southeast Asian reseller CryptoBilis, while Ledger says its own systems and direct sales channels were not compromised.
What Ledger confirmed
The hardware-wallet manufacturer said one device belonging to an affected user contained an unauthorized hardware implant. The confirmation, reported by CoinDesk, provides the first concrete indication that the incident involved physical tampering somewhere in the distribution chain rather than only a software or online attack.
Ledger said the known cases are connected to products distributed through CryptoBilis, which operates in Indonesia, Malaysia and the Philippines. The reseller has suspended sales of its hardware-wallet inventory while the investigation continues.
Ledger said the number of affected devices currently appears limited. In an update published on Oct. 11, the company said all confirmed cases connected with the Oct. 9, 2026, draining incident involved devices sold through CryptoBilis. It also said there was no indication that its internal security infrastructure, systems or services had been breached.
The company said it is contacting affected users and cooperating with relevant authorities. Ledger also reminded distributors to obtain products only through authorized channels and prohibited the restocking of returned devices.
Estimated losses and customer guidance
Ledger has not announced an official total for the losses. Third-party on-chain researchers, however, estimate that between $86 million and $93 million was taken from more than 300 wallets across several blockchains, including Bitcoin, Ethereum and Tron.
The company’s advice differs depending on whether a CryptoBilis customer has used the device:
- Customers with unused devices should not initialize them.
- Customers who have already set up a wallet should move their funds to a new seed created on a device obtained directly from Ledger.
- Affected users should contact official Ledger Support and report the matter to local law enforcement.
A seed is the recovery information used to restore access to a crypto wallet. Ledger has also warned customers to be especially cautious of follow-up scams. It said it will never call or send a direct message asking for a customer’s 24-word recovery phrase.
Why the supply chain matters
Hardware wallets are designed to keep private keys away from internet-connected systems, and many crypto users turned to self-custody after the collapse of FTX in 2022. The Ledger incident shows that offline storage does not remove every security risk: the device, its production process and the path it takes to the customer can also matter.
The company said it is reviewing controls for authorized resellers, strengthening hardware protections and seeking broader improvements in chain-of-custody practices. Ledger described security as an ongoing process and said the incident underscored the need to continue reviewing distribution and anti-tamper measures.
The case also follows a separate incident involving another hardware-wallet maker. In July 2026, a flaw in Coldcard’s seed-generation firmware was estimated by on-chain researchers to have enabled the theft of between $100 million and $130 million in bitcoin. The two incidents involved different circumstances, but both have raised questions about the assumption that physical wallet devices are automatically risk-free.
The precise route by which the CryptoBilis devices were compromised remains unresolved in the source material. Binance co-founder Changpeng Zhao alleged on X that attackers had bought the reseller and made it sign a non-disclosure agreement. That claim has not been independently verified, and CryptoBilis had not immediately responded to requests for comment about the incident or Zhao’s allegation.
Current market picture
Moneyiar market data at 09:39 on Oct. 13, 2026, showed declines across the four listed crypto assets:
- Solana (SOL): $107.0735322491, down 3.91% over 24 hours and 10.34% over seven days.
- Chainlink (LINK): $12.9039257574, down 3.05% over 24 hours and 7.56% over seven days.
- Compound (COMP): $23.4635425813, down 6.38% over 24 hours and 3.76% over seven days.
- edgeX (EDGE): $0.337371181, down 6% over 24 hours and 25.54% over seven days.
These market figures describe price performance at the stated time and do not establish a connection between those movements and the Ledger incident.
