Ledger has confirmed that at least one hardware wallet sold through a Southeast Asian reseller contained an unauthorized hardware implant, and losses tied to the tampered devices may exceed $86 million.
That estimate comes from an investigator called Specter, cited in Cointelegraph's reporting, and it spans Bitcoin, Ethereum, and Tron. Ledger itself has not confirmed how many customers are affected or the total value of the losses. The $86 million figure is an outside estimate, not a company number.
What Ledger is saying
Ledger posted on Sunday on X that it is reaching out to users as part of an ongoing investigation. In a statement to Cointelegraph, the company said the incident "appeared to be isolated" to a single reseller and its market. Ledger said its infrastructure was not compromised, and its systems and services were unaffected.
The reseller is CryptoBilis, which Cointelegraph reported on Friday was listed as an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines. CryptoBilis has stopped selling all hardware‑wallet inventory until the investigation concludes, and Ledger says it is in active communication with the company on next steps.
Ledger is also asking anyone with information about the incident to reach its bounty program at bounty@ledger.fr.
What users are being told to do
The advice is blunt. If you bought a Ledger device from this reseller and have not set it up yet, do not. If you already set it up, Ledger recommends moving your assets to a new Ledger signer with a new seed.
That second part deserves a pause. The fix for a compromised hardware wallet is, apparently, another hardware wallet from the same company. I understand the logic, since this looks like a supply‑chain problem at one reseller rather than a flaw in Ledger's own systems, but it is still a big ask for trust.
The part that should worry everyone
This is the nightmare scenario for hardware wallets, and it has nothing to do with firmware bugs or phishing. The presence of an unauthorized hardware implant suggests that a device was physically modified somewhere between the factory and the buyer. The whole pitch of a hardware wallet is that you do not have to trust anyone, and here the weak point was the box itself arriving pre‑compromised.
A few things stand out to me:
1. Authorized reseller - Not a sketchy marketplace listing, but an authorized channel across three countries. "Buy from the official source" is the standard advice, and this shows how porous that advice gets once distribution chains stretch across regions. 2. Loss reports triggered the discovery - Users reported losing funds, which means the tampering worked well enough to drain accounts before anyone caught it. The reporting so far does not explain how the implant worked or how it was detected, and those details matter a lot for judging whether other batches are clean. 3. Numbers are soft - Ledger has not confirmed a loss figure, the investigation is ongoing, and the affected user count is unknown. The real total could be lower than Specter's estimate or much higher. Nobody knows yet.
If you bought a Ledger from a reseller in any of those three countries, the company's guidance boils down to this: check where it came from, and if it was CryptoBilis, treat the device as hostile.
Sources