Ledger says an unauthorized hardware implant was found in a wallet sold through CryptoBilis, a Malaysia-based reseller whose devices were distributed across Southeast Asia. The company began investigating reports of unexpected cryptocurrency losses on October 9 and later said all user reports it had received were linked to devices sold by that reseller. Ledger described the affected volume as limited, without a published count.

The confirmation does not establish that Ledger’s software or online services were breached. It concerns tampered physical devices in a resale channel. Ledger has not publicly identified the exact model or explained when or how the device was altered.

What Ledger and researchers have reported

Ledger first asked CryptoBilis to stop selling and shipping its devices while it investigated. On October 10, the company confirmed that at least one affected user’s device contained an unauthorized hardware implant and said it was contacting impacted users. In a later update, it linked all unexpected fund-drain reports it had received to devices sold through CryptoBilis.

Ledger did not name the device model. Researchers and security commentators have described implants in Ledger Nano X devices, including devices bought through third-party marketplaces in Japan from sellers whose products shipped from Malaysia. A researcher who examined a specimen said the implant could capture information shown on the device display and button presses, then transmit it over a cellular connection. Those details come from the researchers’ examinations, not from a technical disclosure by Ledger.

The reporting describes two physical variants and says investigators saw signs of deliberate hardware modification. It does not establish how many wallets were altered, whether every reported loss involved the same model, or how long any modified devices were being sold. Ledger said the affected volume was limited but did not publish a device count.

What buyers should do

Ledger advised people who bought a device from CryptoBilis not to begin setup if they had not already done so. For a device that had been set up, the company recommended considering a move to a new signer with a new recovery seed. That is Ledger’s guidance for customers connected to this reseller report.

The incident also highlights a limit in Ledger’s Genuine Check. Ledger warns that the check cannot detect an added implant when the original Secure Element remains intact. A device can therefore pass an authenticity check and still have been physically modified. Ledger advises buyers to use authorized channels and tells its authorized distributors not to restock returned products.

At the time of BleepingComputer’s report, there was no indication that other Ledger resellers were shipping compromised wallets. The company was working with authorities to identify whoever altered the devices. That leaves key details unresolved, including the number of affected wallets and the full route by which each device reached its buyer.

The narrow confirmed point is that Ledger found an unauthorized implant in at least one customer device and linked reported fund drains to a single reseller. Buyers who used that channel should follow Ledger’s current instructions; the report does not establish that other Ledger products or resellers were affected.