Ledger Halts CryptoBilis Sales After Tampered Hardware Wallet Found

Ledger has temporarily stopped selling its hardware wallets through the reseller CryptoBilis after users who bought devices there reported their funds were stolen. The company's investigation found that at least one affected device carried an unauthorized hardware implant.

What happened

Ledger began looking into reports of stolen funds from users in Southeast Asia who bought devices through CryptoBilis.
A pseudonymous blockchain investigator puts the total losses at more than $86 million. Ledger has not confirmed that figure.
Ledger says one affected user's device contained an unauthorized hardware implant. The company is contacting affected users as the investigation continues.
CryptoBilis has stopped selling all hardware wallets until the investigation is finished.
In an update on 11 October 2026, Ledger said a "limited" number of devices are affected, and every confirmed case so far involves a device sold through CryptoBilis.

Ledger hasn't published technical details of the implant yet, and it hasn't said how or where in the supply chain the devices were modified. Until it does, treat any explanation of the mechanism as speculation.

Why it matters

A hardware wallet is only as trustworthy as the path it took to reach you. This is a physical supply-chain attack: the weak point isn't Ledger's firmware or cryptography but a reseller channel the buyer had no reason to doubt. A modified device can look and feel genuine, and the user won't see any warning until the funds are gone.

There's also a common scam pattern to watch for: devices that arrive with a recovery phrase already printed or written down, or that let someone else see the seed. Any wallet whose seed you didn't generate yourself on the device should be treated as compromised.

What to do

If you bought a Ledger from CryptoBilis in the last 90 days:

Not set up yet? Don't initialise it. Wait for guidance from Ledger.
Already set up? Move your assets to a new Ledger device bought through an authorized channel, and generate a new seed on it.

For everyone using hardware wallets:

Buy only from the manufacturer or an authorized reseller. Avoid marketplaces, grey-market sellers and "discounted" stock.
Your recovery phrase must be generated by your device during setup and written down by you. If a phrase came pre-printed, or anyone else has seen it, the wallet isn't safe.
Never share your recovery phrase or PIN. Vendors will never ask for them.
Ignore anyone who offers to "recover" lost funds. Those offers are almost always a second scam.
Run the vendor's genuine-device check during setup, and look for signs the packaging was tampered with.

For organisations holding crypto treasury:

Keep a procurement record (vendor, order, serial) for every signing device. Inspect devices when they arrive.
Use multi-signature setups that span devices from different purchase channels, so one compromised device can't move funds alone.
Include hardware-procurement risk in your third-party / supply-chain risk register.

4Tify will update this article as Ledger publishes more technical findings.

Originally reported by The Hacker News. This summary is 4Tify's own analysis.