Hardware wallet manufacturer Ledger has confirmed that one of the compromised devices at the center of a recent cryptocurrency theft case contained an unauthorized hardware implant. The disclosure adds a significant new dimension to an ongoing investigation into suspected losses exceeding $86 million across Bitcoin, Ethereum, and Tron wallets. Hardware wallets keep the private keys that control cryptocurrency holdings offline, and their security model rests on the device reaching its owner unmodified.

According to a post published on X on Sunday, October 10, 2026 by Ledger Support, the device belonged to one of the impacted users and had been purchased from CryptoBilis, a hardware wallet reseller based in Southeast Asia.

Situation Update: Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to…
— Ledger Support (@Ledger_Support) October 10, 2026

Ledger said it is communicating with the victims of the theft as the investigation proceeds, and that it is reaching out to impacted users. A blockchain investigator who examined the hacking incident has estimated total losses at more than $86 million. The company, however, has yet to confirm how many customers were affected.

Implant Discovery Raises Reseller Security Concerns

The implant was found in one of the devices used by cryptocurrency holders who lost funds in the incident. The confirmation that a hardware wallet contained a component installed without authorization has heightened concerns over the safety of third-party resold devices, particularly in cases where the buyer believes the product came from an authorized source.

Numerous questions surrounding the incident remain open. Ledger has not clarified how the implant was installed in the device or what impact it may have had. The company has stated, however, that no vulnerabilities in its own systems posed a threat, and that the event appears to have been limited to CryptoBilis and the market serviced by the reseller.

Ledger has requested that anyone with information regarding the matter come forward through its bounty program as the investigation continues. Bounty programs are a common mechanism technology companies use to gather information from researchers and the public during security investigations.

CryptoBilis Suspends Hardware Wallet Sales

CryptoBilis has suspended the sale of all hardware wallets while the investigation remains underway. Ledger has confirmed that it is in active dialogue with the reseller regarding further actions, though no specific measures have been announced.

The suspension is intended to ensure that no additional customers acquire potentially compromised devices until the case is resolved. It remains whether the problem is confined to a single batch or affects a larger portion of the reseller's stock.

The discovery has also drawn attention to CryptoBilis's prior reputation as an authorized reseller of Ledger products in Indonesia, Malaysia, and the Philippines. Consumers who purchase through an authorized reseller can ordinarily assume that their product was not tampered with prior to delivery.

Neither party has yet explained how the unauthorized component managed to enter the device. Determining at what stage of the supply chain the product was altered remains a central open question.

Ledger Issues Safety Guidance for Affected Customers

Ledger recommends that consumers who purchased any hardware wallets from CryptoBilis refrain from setting up unused devices until the investigation has been carried out. The guidance applies to any device bought from the reseller that has not yet been initialized. Customers who have already set up their devices may wish to move their funds to another Ledger wallet using a newly generated recovery seed. A recovery seed is the sequence of words generated when a wallet is initialized, and it can restore full access to the wallet's funds.

The case underscores the importance of adhering to security recommendations. Users must avoid disclosing their recovery phrase and should employ trusted devices with new recovery seeds.

Losses Estimated at More Than $86 Million

Reports published on October 9–10, 2026, citing blockchain experts, indicated that losses from suspicious cryptocurrency activity in the affected wallets may exceed $86 million. The losses involve Bitcoin, Ethereum, and Tron wallets.

The $86 million figure is an estimate published by blockchain investigator Specter and has not been confirmed by Ledger. Further investigations are ongoing into the number of customers affected and how the hardware wallet implant could have caused the losses.

The incident is notable both for the potential scale of the financial consequences and because the affected devices were obtained from a reseller previously considered authorized. Hardware wallets can be exposed to modifications made prior to delivery, and the case emphasizes the need to purchase devices from credible sources and to follow official guidance. For buyers, the episode demonstrates that the purchase channel itself can be a critical part of device security.

CryptoBilis customers are advised not to set up their devices until further notice. The investigation between Ledger and CryptoBilis is still ongoing, with no confirmed information yet on the full extent of losses or the number of devices affected.