Ledger confirms hardware implant in wallets sold by reseller CryptoBilis; researchers peg losses near $90M

Ledger has confirmed that at least one wallet tied to a wave of recent fund losses contained an unauthorized hardware implant, and says every confirmed case so far involves devices sold through CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines. It is the first concrete evidence of physical supply-chain tampering in an incident that surfaced on Friday, Oct. 9.

In an Oct. 10 statement, Ledger Support said "one of the impacted users' devices contained an unauthorized hardware implant," per CoinDesk. An Oct. 11 follow-up said the volume of affected devices "appears limited" and that "all confirmed cases" trace to CryptoBilis, which has suspended all hardware-wallet sales pending the investigation. Ledger stressed its own internal systems and direct sales channels were not compromised.

Ledger has not published an official loss figure. Third-party on-chain researchers cited by CoinDesk estimate $86 million to $93 million drained from more than 300 wallets across Bitcoin, Ethereum, and Tron.

Ledger's guidance to CryptoBilis buyers: do not initialize unused devices; if a wallet is already set up, move funds to a new seed on a device bought directly from Ledger. It also warned that scammers exploit such moments and that Ledger will never call, DM, or ask for a 24-word recovery phrase.

Key facts

• Ledger confirmed an unauthorized hardware implant in at least one affected device (Ledger Support, Oct. 10, via CoinDesk).
• All confirmed cases trace to reseller CryptoBilis; Ledger's internal systems and direct channels unaffected (Ledger, Oct. 11, via CoinDesk).
• Researchers estimate $86M–$93M stolen from 300+ wallets across Bitcoin, Ethereum, and Tron — an unofficial figure from on-chain analysts, not Ledger (CoinDesk).
• Incident first disclosed Friday, Oct. 9; CryptoBilis has suspended sales; Ledger says it is cooperating with authorities (CoinDesk).

The real-world read

The loss range is not Ledger's number — the company has confirmed no total, and the $86M–$93M figure comes from unnamed third-party on-chain researchers. Treat it as an estimate, not a settled count, and note the spread.

Ledger's framing does real work here: by repeatedly stressing that its systems and direct channels are clean and that tampering is "strictly isolated" to the CryptoBilis batch, the company draws the blast radius narrowly — plausible on the evidence so far, but it is Ledger drawing it, mid-investigation. How the implant got into the supply chain is still unknown. Binance co-founder Changpeng Zhao claimed on X that attackers "apparently bought the reseller" and bound it with an NDA; that is an unverified allegation, and CryptoBilis did not respond to requests for comment.

The uncomfortable context: this follows a July 2026 Coldcard firmware flaw that researchers estimate drained $100M–$130M in bitcoin. Hardware wallets move keys offline — they do not make them tamper-proof, and the attack surface now plainly includes who you buy from.

This is news coverage, not financial advice.

Sources

• CoinDesk (Oct. 12, 2026) — reputable secondary. Reported and quoted Ledger Support's Oct. 10 and Oct. 11 statements, the CryptoBilis attribution and sales suspension, researcher loss estimates, the CZ allegation, and the July 2026 Coldcard comparison. Ledger's own statements are relayed through this report, not read directly.