Ledger Confirms Tampered Device in CryptoBilis Theft Investigation

Ledger confirmed Oct. 10 that one hardware wallet linked to reseller CryptoBilis contained an unauthorized hardware implant after suspected thefts drained cryptocurrency from customers in Southeast Asia.

The device maker tied confirmed cases to CryptoBilis, which sold Ledger products in Indonesia, Malaysia and the Philippines. Ledger said its internal systems and direct sales channels were not compromised and described the number of impacted devices as limited.

Blockchain transfers linked to the incident totaled about $93.2 million from 315 wallets across TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. The estimate used prices from the morning of Oct. 9, when the suspected thefts began. The largest losses involved $70.5 million from TRON, $16.8 million from Bitcoin and $3.7 million from Ethereum.

Tether froze $10 million in USDT connected to the thefts. CryptoBilis stopped selling hardware wallets while Ledger reviewed the case and its reseller controls.

Ledger has not confirmed the total loss, the number of affected customers or whether the implant caused every theft. It advised buyers who purchased from CryptoBilis within the previous 90 days not to initialize unopened devices. Customers who already initialized them were told to move assets to a new device using a newly generated recovery phrase.