Ledger Confirms Hardware Tampering in Reseller Wallets Tied to a $90 Million Theft

Hardware wallet maker Ledger has confirmed that at least one device linked to a wave of customer fund losses contained an unauthorized hardware implant — the first concrete evidence of physical supply-chain tampering in one of the crypto industry's most unsettling recent episodes.

What Ledger found

In a statement released on October 10, Ledger said it could confirm that one of the impacted users' devices contained an unauthorized hardware implant, according to reporting by CoinDesk. The company said it is actively contacting affected users as part of an ongoing investigation, and that CryptoBilis — the Southeast Asian reseller at the center of the episode — has suspended sales of all hardware wallet inventory until the investigation concludes.

A follow-up update on October 11 narrowed the scope: Ledger said the volume of impacted devices appears limited, and that every confirmed case tied to the draining incident disclosed on October 9 involves devices sold through CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. The company stressed that its internal systems and direct sales channels remain unaffected.

The scale of the losses

Ledger itself has not confirmed an official loss figure. Third-party on-chain researchers have estimated the haul at between $86 million and $93 million across more than 300 wallets, spanning Bitcoin, Ethereum, and Tron, per CoinDesk's reporting. Those estimates are independent of the company's own statements and should be read as such.

The company said it is cooperating with relevant authorities, and reminded its distributor network to source products exclusively through authorized channels — strictly prohibiting the restocking of returned products, a detail that hints at how the tampering may have entered the supply chain.

What customers are being told

Ledger repeated its security guidance for anyone who bought through CryptoBilis: do not initialize unused devices, and if a device is already set up, move funds to a new seed on a wallet obtained directly from Ledger. The company also warned that scammers tend to exploit incidents like this, reminding customers that Ledger will never call, message, or ask for a 24-word recovery phrase.

Speculation about how the supply chain was breached continues to circulate. In a post on X, Binance co-founder Changpeng Zhao alleged the attackers bought the reseller and bound it with a nondisclosure agreement — claims that have not been independently verified, and CryptoBilis did not immediately respond to requests for comment, CoinDesk reported.

Self-custody under stress

The incident lands at a moment when hardware wallets are already under scrutiny. After the 2022 collapse of FTX drove millions of investors into self-custody, physical storage was supposed to be the safest option — yet in July 2026, a flaw in Coldcard's seed-generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers cited by CoinDesk. "Security isn't static," Ledger said in its October 11 post, pointing to strengthened reseller controls and hardware protections as its response.

Crypto prices move fast — figures cited above reflect the source's reporting at publication time, not live market data.

Written by the BidAsk Newsroom. Based on reporting from the sources below.