Ledger said tether buyers need to treat at least one device tied to recent fund losses as physically compromised after it found an unauthorized hardware implant on Oct. 10. The cases so far point to devices sold through CryptoBilis, not Ledger’s direct sales channels, and the company has told affected users to stop using unused units and move existing setups to a new seed.
CryptoBilis devices in focus
Ledger Support said, "Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant." That is the strongest indication yet that the problem is not a routine software issue but a hardware-level tampering case, which pushes the investigation toward how the device entered the distribution chain.
By Oct. 11, Ledger said, "To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis". CryptoBilis operates in Indonesia, Malaysia, and the Philippines, so buyers in those markets have the clearest reason to check whether their device came through that channel.
Ledger and CryptoBilis response
Ledger said its internal systems and direct sales channels remain unaffected, which leaves a narrow but serious split between the company’s own hardware path and reseller-sold inventory. CryptoBilis then suspended sales of all hardware wallet inventory until the investigation concludes, while Ledger said it is actively contacting affected users and cooperating with relevant authorities on Sunday.
Ledger’s own guidance is blunt: "Do not initialize unused devices. If already set up, move to a new seed on a device from Ledger." The practical message is simple for anyone who bought through CryptoBilis — stop trusting the current device until it is replaced or re-seeded, and do not hand over the 24-word recovery phrase to anyone who contacts you.
Losses and limits
Third-party on-chain researchers estimated losses at between $86 million and $93 million across more than 300 wallets on Bitcoin, Ethereum, and Tron. That range suggests the impact is broad enough to matter beyond a single account or one blockchain, but the hardware-implant finding ties the physical-device question to a limited reseller path rather than Ledger’s wider customer base.
Ledger also said, "Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes". The open question now is how the unauthorized hardware implant reached the affected devices in the first place, because the answer will determine whether this was a manufacturing problem, a shipping problem, or a reseller-stage breach.
