Ledger has confirmed finding an unauthorized hardware implant in at least one cryptocurrency wallet linked to reported customer losses in Southeast Asia. The company said all confirmed cases involve devices distributed by CryptoBilis, a reseller serving Indonesia, Malaysia and the Philippines.
The finding follows reports of missing funds on October 9, 2026. Ledger says its internal systems and direct sales channels remain unaffected, while investigators continue examining the altered device and the reported thefts. It has not said how many modified devices may be circulating.
In an October 10 update, Ledger Support confirmed that one affected customer's device contained an unauthorized hardware implant. The company did not identify the wallet model or explain how the added hardware entered the product before reaching its owner. The finding confirmed physical tampering but not the full attack method.
On October 11, Ledger said the number of affected devices appeared limited. "All confirmed cases" linked to the October 9 incident involved CryptoBilis purchases, it said. However, the company has not released a verified victim count or confirmed that the implant caused every reported loss. It said it was contacting affected users.
Blockchain analytics firm Bitquery estimated that attackers stole approximately USD 102 million from 324 wallets across six blockchains. Its October 12 update added nine previously unidentified Tron wallets that lost another USD 8.8 million in USDT. Earlier estimates had placed total losses between USD 86 million and USD 93 million. The revised figure covers transfers traced to the October 9 thefts.
The investigation covered Bitcoin, Ethereum, Tron, Solana, BNB Chain and Polygon. Bitquery said 25 Tron wallets approved access to their funds within three seconds. It also reported that Tether froze approximately USD 10 million in USDT linked to the thefts. These figures remain independent estimates, not losses officially confirmed by Ledger. Researchers also traced two weeks of smaller test transactions.
Ledger's security documentation explains that its Genuine Check verifies the authenticity of a wallet's secure chip. However, it cannot identify unauthorized physical changes if that chip remains intact. A genuine device can therefore pass the check despite containing an added component. The check cannot establish whether hardware was modified during distribution.
Separately, Tibane Labs examined modified Ledger Nano X devices obtained through Japanese marketplaces. Researchers described implants capable of reading recovery words displayed on the wallet screen and sending them through cellular networks. They did not establish that those devices came from CryptoBilis or contained the same implant Ledger identified. Ledger has not publicly described the implant recovered in its investigation.
Ledger has advised customers who bought unused devices through CryptoBilis not to activate them. Customers already using such devices should move their assets to wallets with newly generated recovery phrases on devices purchased directly from Ledger. Reusing the old phrase could leave funds exposed. The replacement device must generate a completely new recovery phrase.
CryptoBilis has stopped selling hardware wallets while the investigation continues. Ledger said it is working with authorities and contacting affected customers. It also warned that its support team never requests recovery phrases by telephone or private message. The company instructed resellers not to restock returned products.
The company has yet to disclose how many devices were altered, where the tampering occurred or whether the implant explains every theft. Those questions remain part of the continuing official investigation.
ALSO READ: Koscom Advances Tokenized Securities Plans Ahead of 2027 Regulations