Ledger confirms unauthorized hardware implant as reseller-linked losses may exceed $86 million
Key Takeaways
- •Ledger confirmed that a device belonging to one of the affected users contained an unauthorized hardware implant, shifting focus to the physical devices themselves rather than the company's online services.
- •The losses involve Ledger devices purchased through CryptoBilis, which was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.
- •Investigator Specter estimated the losses across Bitcoin, Ethereum and Tron may exceed $86 million, though Ledger has not confirmed the number of affected customers or the total value of the losses.
- •CryptoBilis halted sales of all its hardware wallet inventory as a precaution pending the conclusion of Ledger's ongoing investigation.
- •Ledger advised customers who have not yet set up devices from the reseller to refrain from doing so, and those who already have to move their assets to a new Ledger signer using a new seed.
Hardware wallet maker Ledger, whose devices are designed to keep users' private keys offline, has confirmed that a device belonging to one of the users hit by recent crypto losses contained an unauthorized hardware implant. The losses involve Ledger devices purchased through a reseller in Southeast Asia.
The confirmation puts the focus on the devices themselves rather than on Ledger's online services — the core reason users choose hardware wallets in the first place, since keys are meant to be generated and stored offline, away from internet-connected threats.
In a Saturday post on X, Ledger said it was contacting users as part of its ongoing investigation into the incidents, which investigator Specter estimated may exceed $86 million across Bitcoin, Ethereum and Tron.
Ledger asked anyone with information relevant to the investigation to contact its bounty program at bounty@ledger.fr.
As a precaution, reseller CryptoBilis confirmed in the same post that it had halted sales of all hardware wallet inventory until the investigation concludes. Ledger said it is in active communication with CryptoBilis on next steps.
Related: Ledger investigates fund losses linked to Southeast Asian reseller, warns users
Ledger advised customers who bought a device from the reseller not to initiate device setup if they have not yet done so. Those who have already set up their device should consider moving assets to a new Ledger signer, including using a new seed — the recovery phrase from which a wallet's private keys are derived and which therefore controls access to its funds.
Cointelegraph reported on Friday that CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger has not confirmed how many customers may be affected or the total value of the reported losses, leaving the final scope of the incident — and the verified loss total — among the key details still to be established as the investigation continues.
In a statement to Cointelegraph, Ledger said the incident appeared to be isolated to the single reseller and its market. "Ledger's infrastructure, systems and services were not compromised," the company said, adding that its investigation remained ongoing.
For assistance or questions, customers can contact Ledger through its official support channels at
