Ledger is working with authorities after users of its hardware wallets last week reported losing funds and one customer received a tampered device, though the Paris-based manufacturer reassured customers that the number of impacted products was “limited.”

In an announcement posted on Sunday, the company said it had also reached out directly to affected customers.

The investigation began after Ledger said on Friday that it had started looking into reports from customers in South East Asia who lost funds after buying devices from a reseller. On Saturday, the company said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.

Hardware wallets are built to keep users’ private keys offline, signing transactions without exposing the credentials that control their funds. That security model depends on the device arriving untouched, so an unauthorized implant embedded in the hardware falls outside the threats it is designed to counter.

Ledger has not confirmed how much money was lost, but blockchain investigator Specter said $86 million had been drained from devices.

“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday in an announcement on X. Its Ledger Support account shared additional updates, including a follow-up post on the platform.

It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.

“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”

Customers in South East Asia reported losing funds last week after purchasing devices from CryptoBilis, a vendor based in Kuala Lumpur, Malaysia. Ledger advised customers who had bought from CryptoBilis not to set up their devices, as Bitcoin Magazine previously reported. According to Sunday’s announcement, CryptoBilis has since stopped selling hardware wallets.

The distinction matters because phishing relies on tricking users into surrendering credentials online, whereas an implant sits inside the hardware from the moment the device is unboxed, before setup even begins.

Users on social media have posted photographic evidence of implants fitted inside Ledger products, claiming the modifications could expose users’ private keys. It remains unclear how many of Ledger’s signing devices contained the implant.

Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine. With the investigation ongoing, what to watch next is what authorities uncover and whether a definitive device count and verified loss total are confirmed.

Hardware wallet security has been under intense scrutiny since hackers stole close to $120 million in bitcoin from Coldcard users in July, as Bitcoin Magazine reported at the time. The devices, made by Canadian company Coinkite, contained a firmware bug that led to faulty seed generation, effectively allowing hackers to guess investors’ seed phrases.

In a separate incident last month, hardware wallet manufacturer Trezor reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen, as Bitcoin Magazine covered.

Criminals have been targeting customer data throughout the year, with scammers obtaining information via Global-e, the payment processor used by Ledger, to send phishing emails. Taken together, the incidents show the attack surface stretches across the full path a device travels — firmware, fulfillment, payment processing and resale channels.

This article was written by Mathew Di Salvo and first appeared on Bitcoin Magazine.