Ledger, a leading manufacturer of cryptocurrency hardware wallets, has temporarily halted sales through the reseller CryptoBilis. This decision follows reports of unauthorized hardware implants within devices sold by the reseller, leading to significant fund thefts.
Investigation Into Fund Thefts
The company is currently investigating multiple reports of lost funds from users across Southeast Asia who purchased wallets from CryptoBilis. These reports, according to blockchain investigator Specter, suggest losses exceeding $86 million. In response, Ledger has advised customers who acquired devices from this reseller in the past 90 days to avoid setup if possible, or to transfer assets to a new Ledger device for safety.
Ledger’s investigation revealed that some devices contained unauthorized hardware implants. As a precautionary measure, CryptoBilis has suspended all hardware wallet sales until the investigation concludes. Users are warned not to trust any recovery phrases supplied with their devices and are reminded to keep these phrases private.
Details of the Unauthorized Implant
In an update on October 11, 2026, Ledger provided further insight into the implant issue, which affected a limited number of devices exclusively sold through CryptoBilis. The implant was engineered to stealthily capture the wallet’s seed phrase during setup and transmit it via LTE. It does not interfere with the Ledger’s Secure Element or operating system but poses a substantial security risk.
Tibane Labs reported on three implant variants, with the latest being the most advanced. An implant was traced back to a purchase from Amazon Japan, shipped from Malaysia, highlighting the complex distribution chain involved.
Retail Response and Security Measures
Following these revelations, MediaMarkt Saturn has suspended sales of Ledger products in Germany after a customer reported an implant. No asset losses were confirmed in Europe, and Ledger encourages users to submit potentially compromised devices for analysis.
To further prevent unauthorized sales, Ledger has paused its devices’ availability through several authorized resellers, including CryptoBilis, Shopee Mall, and LazMall. Users are urged to utilize Ledger’s “Genuine Check” mechanism to verify device integrity, although physical tampering detection remains limited.
Continued Investigation and Warnings
On October 13, 2026, Ledger expanded its sales suspension to resellers in Southeast Asia and Hong Kong, maintaining that confirmed incidents are restricted to these regions. The ongoing investigation seeks to identify those responsible for the tampering within the distribution chain.
Ledger reassures customers that its core infrastructure and services remain secure. The company emphasizes that it will never request users’ recovery phrases or directly contact them for such information, urging vigilance against scams.
