Ledger confirms hardware implant in wallet sold by CryptoBilis

On October 10, 2026, Ledger confirmed that a device belonging to a victim contained an unauthorized hardware implant. The cryptocurrency hardware wallet maker had been investigating since October 9 thefts of funds reported by customers. On October 11, it clarified that all confirmed cases involved devices sold by CryptoBilis, a reseller operating in Malaysia, Indonesia and the Philippines. On the morning of October 12, according to Next, Ledger removed CryptoBilis from its list of authorized resellers.

What Ledger confirms, and what remains to be established

Ledger says its internal systems and direct sales channels were not compromised. It describes the number of affected devices as “limited” and says it is contacting victims and cooperating with authorities. The company did not specify the affected model or the amount of the losses.

The figures in circulation come from researchers who analyze blockchain transactions. The Specter account puts the total at $86 million. Bitquery estimates the damage at $93.2 million, spread across 315 wallets. According to CoinDesk, the thefts affect the Bitcoin, Ethereum and Tron networks. Ledger has not confirmed that all these losses stem from the implant.

For its part, CryptoBilis has suspended the sale of all its hardware wallets until the investigation ends. According to Next, its founders say on LinkedIn that they sold the company in March 2026.

How the implant would work

Mark Karpelès, former head of the Mt. Gox exchange, warned in mid-September about modified devices. According to his description, which Ledger has not adopted, the implant includes a microcontroller, an eSIM card and an LTE cellular module. It would read the data sent to the screen and the button presses to capture the 24-word recovery phrase at the moment the user generates it. It would then send it to the attacker over the mobile network.

Cited by BleepingComputer, Tibane Labs described two variants. The first replaces the original battery with a smaller one to make room for the circuit. The second sits under the screen, and its components have had their reference markings erased.

One point is important. Ledger's authenticity check (Genuine Check) verifies the secure chip. It cannot detect an added circuit if that chip is intact.

What should you do?

• If you bought a device from CryptoBilis and have not set it up yet, do not set it up.
• If you have already set it up, transfer your assets to a new device bought directly from Ledger, with a new recovery phrase.
• Only buy a hardware wallet from the manufacturer or an authorized reseller. Be wary of marketplaces and rock-bottom prices: according to researchers, modified devices were sold at nearly half price.
• Ledger reminds users that it never asks for your 24-word phrase, whether by phone or by message.
• If you are a victim, contact Ledger's official support and file a complaint.

A European user claims to have found an implant in a Ledger bought at Mediamarkt. Next reports this account, which is unverified at this stage.