Ledger Finds Unauthorized Hardware Implant in Wallet Supply Chain

Ledger said Oct. 10 that one customer’s hardware wallet contained an unauthorized hardware implant, raising supply-chain security concerns as the company investigates suspected cryptocurrency losses linked to Southeast Asian reseller CryptoBilis.

Ledger asked CryptoBilis to pause sales and shipments while the investigation continues. The company has not confirmed that the implant caused the reported losses, and the number of affected devices and users remains unknown.

Customers who bought Ledger devices from CryptoBilis within the previous 90 days were advised not to initialize them. Customers who already initialized their devices were told to consider moving assets to a new Ledger signer with a newly generated seed.

Estimates of suspected losses range from more than $72 million to $93.4 million across Bitcoin, Ether and Tron transactions. Ledger has not confirmed those figures, which may cover different addresses or transactions.

CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger has not disclosed how the implant was introduced, what it can do or how many devices may be affected. The company said there is no indication that its security infrastructure, systems or services were compromised.