Ledger has confirmed the discovery of an unauthorized hardware implant in a device connected to the CryptoBilis incident, as blockchain investigators estimate cryptocurrency losses exceeding $86 million.

The October 9 incident involved hardware wallets sold through CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. In an update issued on October 11, Ledger identified the reseller as the source of all confirmed cases while investigations continued.

72 hour update on reseller CryptoBilis incident As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.Enumeration mark removed…

— Ledger (@Ledger) October 11, 2026

The company said its internal systems and direct sales channels remain unaffected. For hardware wallet owners, the episode points to a threat model that sits outside software security altogether: the integrity of the device itself before it is ever set up. Even so, the discovery of tampered hardware has introduced a physical security concern alongside the reported thefts, with investigators still working to establish the full extent of the incident.

The number of affected devices remains undisclosed, and the manufacturer has not confirmed the total financial losses. CryptoBilis, meanwhile, has stopped selling hardware wallets as the investigation proceeds with the relevant authorities.

Blockchain Analysis Estimates $93.2M Taken From 315 Wallets

Blockchain intelligence firm Bitquery estimated that approximately $93.2 million was taken from 315 wallets across Bitcoin, Ethereum, TRON, BNB Chain and Polygon. Its analysis also found that some of stolen funds moved through additional addresses after the initial thefts.

The estimate exceeds separate reports placing the suspected losses above $86 million. However, neither figure represents an official loss assessment from Ledger, which has not confirmed the total amount stolen.

Reports of missing cryptocurrency emerged on October 9, when users linked disappearing funds to wallets associated with devices purchased through CryptoBilis. Investigators subsequently identified an unauthorized hardware component inside one affected device.

Hardware wallets typically isolate private keys from internet-connected devices to reduce exposure to online attacks. Physical modifications, however, can undermine those protections if malicious components are used to compromise sensitive information. Investigators have not publicly established how the affected devices were compromised, or whether the hardware implant caused every reported loss. As a result, the connection between the discovered component and the broader thefts remains under investigation.

Ledger Issues Security Guidance and Reviews Reseller Controls

Ledger has advised customers who purchased devices through CryptoBilis to take precautions based on their devices' initialization status. Buyers who have not initialized their devices should not set them up. Customers who have already initialized their wallets, on the other hand, should transfer their assets to a new Ledger device using a newly generated recovery phrase. The company has also directed affected users to its official support website for assistance.

The incident has prompted a review of authorized reseller controls, hardware protections and distribution procedures. Ledger has also warned distributors against restocking returned devices, cautioning that the practice could introduce modified products into the supply chain.

Customers have therefore been urged to avoid unauthorized sellers, as hardware wallets obtained through such channels could be counterfeit, modified or outside manufacturer security guidelines. The company has additionally warned about follow-up scams targeting people affected by the incident.

Ledger said it will never call customers, send direct messages or request their 24-word recovery phrases. Users should therefore avoid sharing recovery information with anyone claiming to provide technical support.

The investigation remains ongoing. Open questions include how many customers were ultimately affected, whether Ledger confirms a final loss figure, what the work with relevant authorities reveals about how the devices were compromised, and what the company's review of reseller controls and distribution procedures finds.