Ledger Confirms Unauthorized Hardware Implant in Wallet

Hardware wallet manufacturer Ledger confirmed on Saturday that at least one device tied to an ongoing investigation into its Southeast Asian reseller, CryptoBilis, contained an unauthorized hardware implant, as Cryptopotato reported. The confirmation followed initial reports of losses exceeding $86 million from wallets purchased through CryptoBilis in Indonesia, Malaysia, and the Philippines.

What Ledger has confirmed

In a Saturday evening update, Ledger said it examined one device belonging to an impacted user and discovered the implant. The company stated that its own security infrastructure, systems, and services were not compromised, and that the incident appeared isolated to the single reseller and its market. Ledger has not yet determined how many affected devices contain implants or confirmed that the discovered implant is responsible for all reported wallet drains.

CryptoBilis, the reseller in question, responded to Ledger’s request to halt sales of all hardware-wallet inventory—not only Ledger products—until the investigation is concluded. Ledger is in active communication with CryptoBilis and has asked anyone with information to contact its bounty program at bounty@ledger.fr. For users who purchased a device from this reseller, Ledger recommends not initiating setup if they have not yet done so. If the device is already set up, users should consider moving assets to a new Ledger signer, including generating a new seed.

European report raises questions, but remains unconfirmed

A post from one X user claimed that a Ledger purchased through MediaMarkt, an official reseller for Ledger in several European markets including Germany and Austria, also showed signs of possible hardware manipulation. The claim quickly circulated, prompting warnings that the incident may no longer be geographically isolated to Southeast Asia. However, the European situation has not been confirmed as compromised by Ledger, and users examining the published images disagree about what they show. Some argued the hardware appears inconsistent with a genuine Ledger board, while others said they could not see the same type of additional implant identified in the Southeast Asian case.

PANews reported on October 11, citing Bitcoin News, that a security researcher known as Johannes disclosed a hardware wallet purchased from an official European Ledger reseller was found to contain an unauthorized hardware implant several weeks after purchase. The device reportedly showed suspicious wiring not present in normal Ledger hardware. Researchers noted the implant appears to use an earlier design, while newer implant components may be hidden behind the screen, making detection more difficult. No funds have been stolen from that device so far, and it is unclear whether the implant is faulty or the attacker is waiting for more devices to be compromised.

As suspected related cases have emerged in Asia, South America, and Europe, concerns over the scope of the supply chain attack have intensified. Researchers also pointed out that Ledger’s official Genuine Check software is mainly used to verify device authenticity and may be unable to detect unauthorized physical hardware modifications when the original Secure Element has not been compromised.

Why it matters

This incident highlights a critical vulnerability in the hardware wallet supply chain: even devices from reputable manufacturers can be compromised if a reseller or intermediary tampers with them before sale. For users in affected regions, the immediate risk is financial loss, and the reported losses already run into the tens of millions. The emergence of a possible European case, if confirmed, would suggest the problem is not contained to one part of the world, raising broader questions about how hardware wallets are distributed and verified. While Ledger maintains that its own systems are secure, the event underscores the importance of purchasing directly from official sources and following security best practices.

What to watch

Ledger’s investigation is ongoing, and the company has not yet released a full list of affected devices or confirmed the total number of compromised wallets. Updates from Ledger and CryptoBilis, as well as any verification of the European reports, will be key. Users who purchased devices from CryptoBilis should monitor official channels for guidance.

Sources: CryptoPotato, Cointelegraph, PANews