Ledger has confirmed finding an unauthorized hardware implant inside a customer’s cryptocurrency wallet during an investigation into reported thefts involving CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines.
According to Ledger’s October 10 statement, the company’s security team discovered an additional electronic component in an affected customer’s device. Ledger described it as an “unauthorized hardware implant” but did not disclose the exact device model, installation method, or whether it transmitted information. The company stated it has not established whether the implant caused the reported cryptocurrency losses.
Reports of unauthorized transactions emerged on October 9 among customers who purchased Ledger products through CryptoBilis. Following complaints, Ledger opened an investigation and asked the distributor to suspend sales and shipments. CryptoBilis subsequently confirmed suspension of all hardware wallet sales during the investigation.
Former Mt. Gox CEO Mark Karpelès reported examining a suspicious Ledger Nano X device from Malaysia on October 9, finding an additional electronic component hidden behind the device’s display. Technical analysis by Tibane Labs described the modification as involving a microcontroller, cellular communication hardware, and connections to the screen’s internal data lines. Researchers suggested that a component positioned along the screen connection could potentially capture information displayed during wallet setup, including recovery phrases that could allow unauthorized access to funds.
Blockchain analytics firm Bitquery estimated approximately $92.9 million had been removed from 311 wallets across Bitcoin, Ethereum, TRON, BNB Chain, and Polygon. The Block reported earlier estimates exceeding $72 million. Ledger has not confirmed either amount.
Ledger emphasized that it found no evidence suggesting its internal security infrastructure, systems, or services were compromised. The company is developing additional protections against physical device tampering.
Customers who purchased devices through CryptoBilis have been instructed not to set them up if not already done. Ledger recommends customers who have used affected devices transfer cryptocurrency to a new hardware wallet initialized with a completely new recovery phrase, rather than transferring an existing recovery phrase that may have been exposed.
Former CryptoBilis executives Arravind Prabu and Vimalatheethan stated they transferred operational control following an ownership change in March 2026 and no longer controlled company systems or customer databases. Their statement does not establish who modified the affected device or whether the ownership change connected to the incident.
Key facts
- Ledger confirmed finding an unauthorized hardware implant in one customer’s wallet sold through CryptoBilis
- Bitquery estimated $92.9 million in cryptocurrency losses across 311 wallets
- Researcher Mark Karpelès found suspicious electronics behind a Ledger Nano X screen obtained from Malaysia
- CryptoBilis suspended sales of all hardware wallets during the investigation
- Ledger recommends affected customers use new recovery phrases on replacement devices, not transfer existing ones