Ledger devices sold through CryptoBilis, the brand’s authorized reseller for Indonesia, Malaysia and the Philippines, carried an unauthorized hardware implant. On-chain investigators put the losses somewhere between $86M and $103.4M across Bitcoin, Ethereum and Tron. Ledger says its own systems were never compromised and that every confirmed case runs through that one reseller.
Key Takeaways
- Ledger devices bought from the reseller CryptoBilis hid an unauthorized hardware implant.
- Loss estimates range from $86M to $103.4M, with 10M USDT frozen by Tether.
- Ledger tells buyers not to set up these devices and to move their funds.
Get an AI Summary of This Article
ChatGPTHow Tampered Ledger Devices Drained More Than 300 Wallets
The story broke on Friday, October 9. Ledger said it was investigating missing funds reported by customers who had bought their Ledger devices from CryptoBilis, an authorized reseller covering Indonesia, Malaysia and the Philippines. The company immediately asked the reseller to halt every sale and shipment.
A day later, Ledger confirmed it had found an unauthorized hardware implant inside at least one device belonging to an affected customer. It was the first physical evidence behind the theory that devices had been tampered with before they reached their buyers.
The company set out its position in the statement posted on Ledger’s official support account on X. Ledger wrote that its infrastructure, systems and services were not compromised, and opened the address [email protected] for anyone holding information useful to the investigation.
The first numbers came from on-chain sleuths. Researcher tanuki42 counted more than $72M moved to suspected theft addresses, while analyst Specter put the losses above $86M across Bitcoin, Ethereum and Tron. Analytics firm Bitquery later landed on $93.2M spread over 315 wallets and six blockchains.
Investigator YFarmX went further on October 12, tracing $103.4M siphoned from 530 addresses on seven blockchains. Three quarters of that total left as USDT on Tron. Ledger has confirmed none of these figures.
The incident revives a debate from the summer, when ZachXBT called hardware wallets unusable and saved his harshest words for Ledger. This time the weak point sits where buyers have the least control, in the distribution chain that gets Ledger devices into their hands.
CryptoBilis, an Authorized Reseller That Changed Hands
Ledger published an update on October 11, 72 hours into the investigation. Every confirmed case involves Ledger devices sold by CryptoBilis, and the company described the number of affected units as limited. Its internal systems and direct sales channels are unaffected.
CryptoBilis has stopped selling hardware wallets until the investigation wraps up. Ledger’s official map of authorized resellers now lists the company as “Sales temporarily paused” under Malaysia.
The reseller’s ownership raises questions of its own. Company registry documents reported by Philippine outlet BitPinas show CryptoBilis changed hands in March 2026. Since August 3, a single shareholder based in China’s Heilongjiang province, identified as Jiaming, has held the entire capital.
Binance co-founder Changpeng Zhao described the incident as a supply chain attack on a single vendor of Ledger devices. He also claimed the attackers had apparently bought the reseller, a claim nobody has verified so far.
Former Mt. Gox chief Mark Karpelès said he found an extra circuit board inside a Ledger from Malaysia, fitted with an LTE module, an eSIM and an antenna. He noted that his units came from unauthorized sellers on Amazon, and Ledger has not confirmed his findings.
One X user also claims to have found Ledger devices with identical modifications in European retail stores. Ledger maintains that all confirmed cases trace back to CryptoBilis. Hardware wallet logistics had already failed once in August, with the exposure of 13,689 Trezor customer records at its shipping partner ShipMonk.
Also on Cryptonomic:
- Seized Bitcoin: US Government Moves 833.6 BTC
- When a Layer 2 Shuts Down, How to Get Your Funds Out
- Bitcoin Slips Below $84,000 as Brent Climbs to $101.50
What Ledger Asks Owners of Ledger Devices to Do
The stolen funds followed a route Chainalysis describes as a sophisticated cross-chain money laundering operation. The USDT was swapped into USDD, Tron’s stablecoin that Tether cannot freeze, then turned into ether through THORChain.
YFarmX tracked seven waves of deposits into the Tornado Cash mixer, including 2,810 ETH, before the money moved into Zcash’s shielded pool. Tether, for its part, blacklisted 10M USDT across 37 addresses on October 9. The frozen amount covers roughly a tenth of the estimated losses, and the rest is still moving.
CertiK’s tracking dashboard puts hack losses since October 1 at $116.1M across 26 incidents. That October total is dominated by the CryptoBilis case and the Ledger devices it sold.
For anyone who bought through that reseller, Ledger’s instructions are specific. A device that was never set up should stay that way. A device already in use means moving the funds to a brand new recovery phrase, created on a unit bought directly from Ledger. The company then asks victims to contact its official support and report the theft to local law enforcement.
Ledger repeats that it will never call customers, never message them privately and never ask for their 24-word recovery phrase. On Amazon, Shopee or Lazada, a “Ledger Authorized Store” is run by an authorized reseller, and its operator can be checked against the brand’s official list.
Holders weighing how to store their coins can compare costs and use cases in our guide to choosing between a cold wallet and a hot wallet. For Ledger devices bought in Southeast Asia, what comes next now depends on the investigation and on the authorities handling the case.
Follow the story on Cryptonomic.
