Ledger confirms an unauthorised hardware implant in a wallet sold by its Southeast Asian reseller CryptoBilis, as on-chain trackers estimate US$72–86 million drained from buyers in Malaysia, Indonesia and the Philippines
Hardware wallet maker Ledger said on 9 October 2026 that it was investigating reports of stolen funds from users in Southeast Asia who bought its devices from CryptoBilis, a reseller listed in Ledger's official directory for Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments. Ledger advised anyone who bought from CryptoBilis in the last 90 days not to set up the device, and anyone who already had to move their assets to a new Ledger signer with a new recovery phrase. On 10 October Ledger Support confirmed that one affected user's device contained an unauthorised hardware implant, said it was contacting affected users and working with authorities and the SEAL 911 crypto incident-response group, and said CryptoBilis had suspended sales of its whole hardware-wallet inventory. Ledger says it believes the drained funds are limited to devices sold through CryptoBilis and has no indication that its own infrastructure, systems or services were compromised. The Block (9 October) reported on-chain estimates of suspected losses above US$72 million and above US$86 million across Bitcoin, Ethereum and Tron, which Ledger has not confirmed. Former Mt. Gox chief Mark Karpelès published teardown photos of a Malaysian-bought unit with a small component hidden under the screen, which researchers describe as a cellular implant that reads the 24-word recovery phrase off the display during setup and would still pass Ledger's genuine-device check; Ledger has not described its implant or said how it got into the device. Lesson for anyone holding keys on hardware: buy direct from the manufacturer where possible, and treat a recovery phrase shown on any device as exposed if the device's supply chain is in doubt. Primary: Ledger Support statements on X.
- Product
- Ledger hardware wallets sold through reseller CryptoBilis (Indonesia, Malaysia, Philippines)
- Versions
- n/a
Primary: Ledger Support on X — situation update: unauthorised hardware implant confirmed in an impacted user's device (10 Oct 2026) · Vendor: Ledger Support on X — investigating fund losses from CryptoBilis buyers; sales and shipments paused (9 Oct 2026) · The Block — Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million (9 Oct 2026)