Hardware wallet giant Ledger has confirmed that a tampered board was found fitted inside one customer's device, escalating an investigation into fund drains tied to Southeast Asian reseller CryptoBilis that on-chain analysts now estimate at anywhere from $86 million to more than $93 million. The company made the admission in a weekend update published on X, saying it was reaching out to affected users as the probe continued and asking anyone with information to contact its bounty address.
The confirmation marks a sharp turn in a case Ledger opened on October 9, when it said it was looking into reports of losses from buyers who had purchased devices through CryptoBilis — an approved reseller across Malaysia, Indonesia and the Philippines — and ordered the distributor to halt both sales and deliveries the same day. CryptoBilis has since stopped selling its entire hardware wallet inventory while the investigation runs.
Why it matters
This is the largest supply-chain scare to hit a major hardware wallet maker in years, and it strikes at the one assumption self-custody relies on: that the device itself is the last thing an attacker can touch. Most Ledger-related thefts historically traced back to the owner — a phished seed phrase, a fake support call, a cloned app. If the implant theory holds, buyers who did everything right had their keys exposed from the moment of setup, because the hardware was tampered with before the box was ever opened.
The numbers tell the scale. Independent tracker Yfarmx pegged the suspected drain at $93.4 million spread over 471 wallets; Bitquery estimated roughly $92.9 million across 311 wallets; Specter, the researcher Ledger cited, estimated more than $86 million spanning Bitcoin, Ethereum and Tron; MistTrack's running total sits near $90 million. One victim alone lost 80 BTC — worth about $6.6 million at today's snapshot price of $82,972 — roughly a week after buying a new device from the reseller. The company has verified none of those tallies, and stressed that its own servers, systems and services remained untouched.
The attacker's traced holdings are unusually visible. On-chain reads show the actor holding roughly $70.6 million in assets, including 11,406 ETH (about $28.5 million at today's $2,500), 213.37 BTC and 13.65 million USDD. Tether has been freezing USDT at linked addresses, but Bitquery's wider analysis says 14.9 million USDT was already swapped into USDD, which Tether's blacklist controls do not cover. For context on how this landed on Bitcoin's week, see our Bitcoin below $83K as ETF outflows hit coverage, and for the stablecoin mechanics at play, the China P2P stablecoin surge story.
Ledger insists its own servers were never touched. That distinction will mean very little to the people whose coins are gone.
What to watch
- Ledger's next investigative update — the company has not confirmed the attack vector or how many devices carry implants.
- Whether Tether's freezes actually dent the attacker's holdings, or whether the USDD conversion route renders the blacklist symbolic.
- CryptoBilis's promised update within three business days on its internal review and customer remedies.
- Whether any other reseller channel shows up in the tracing — Ledger says the incident is isolated to one reseller and its market, but that claim is being stress-tested in real time.
Key points
| Figure | Detail |
|---|---|
| $86M-$93.4M | Range of on-chain loss estimates (Specter / Yfarmx / Bitquery / MistTrack) |
| 311-471 | Victim wallet counts per tracker |
| 80 BTC | Single largest reported victim loss (~$6.6M at today's price) |
| 11,406 ETH + 213.37 BTC | Attacker's traced holdings (~$70.6M total) |
| 14.9M USDT | Swapped to USDD to dodge Tether's freeze, per Bitquery |
- Ledger confirmed an unauthorized hardware implant in one impacted user's device on October 11.
- CryptoBilis, an approved reseller serving Malaysia, Indonesia and the Philippines, has paused all hardware wallet sales.
- Mark Karpeles, who once ran the now-defunct Mt. Gox exchange, separately published findings of a modified Ledger Nano X with a hidden circuit board and cellular hardware that could intercept recovery phrases during setup.
- Ledger's guidance: buyers from the last 90 days should not initialize unopened devices; those already set up should shift funds to a replacement Ledger initialized from a brand-new seed.
- Ledger says its core infrastructure and services are untouched; SEAL 911 is assisting the investigation.
MarketRadar take
The implant confirmation is the worst-case outcome for hardware-wallet trust in the short term: an approved sales channel — exactly the channel Ledger tells customers to use instead of random marketplaces — is now a verified vector, which blows up the mental model millions of holders rely on. But the market has not priced this as a Bitcoin problem. BTC held near $82,972 through the entire news flow, and ETH sat at $2,500, consistent with a security incident rather than anything structural to the protocols themselves. The real tell going forward is recovery math, and it is ugly: roughly $70.6 million sits in traceable attacker wallets, yet the 14.9 million USDT-to-USDD swap shows how fast blacklist tools can be routed around. Frozen tokens are not returned tokens, and every hour the attacker holds 11,406 ETH without moving it is an hour law enforcement has to coordinate across chains and jurisdictions. Watch the ETH first — it is the largest single pile, and exchange deposits from it would mark the shift from theft to laundering, which is usually when arrests start appearing.
