Ledger Halts Sales With CryptoBilis After Finding Hardware Implants in Stolen Wallets
Ledger paused sales with reseller CryptoBilis after discovering unauthorized hardware implants in devices linked to over $86 million in stolen crypto funds.
Key points
- Ledger found unauthorized hardware implants in devices sold by reseller CryptoBilis.
- The incident resulted in more than $86 million in losses for users in Southeast Asia.
- Ledger advises users who bought from CryptoBilis in the last 90 days to move assets to new devices.
Cryptocurrency hardware maker Ledger temporarily paused sales of its products through reseller CryptoBilis on Friday after investigating reports of stolen funds. The company stated it was looking into loss of funds from users in Southeast Asia who purchased devices from the vendor, according to The Hacker News.
Ledger revealed that one impacted user’s device contained an unauthorized hardware implant. Blockchain investigator Specter reported that the incident resulted in losses totaling more than $86 million. CryptoBilis has ceased sales of all hardware wallet inventory until the investigation concludes, out of an abundance of caution.
Context and Background
Ledger acknowledged in an update posted on October 11, 2026, that the incident impacted a limited number of devices. The company confirmed that all verified cases involved devices sold exclusively through CryptoBilis. Ledger is currently reaching out to impacted users as part of its ongoing probe into the incident.
The company emphasized that users should not purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit, or modified devices is significant. Ledger noted that such devices do not operate under its security guidelines. Resellers and distributors were advised to source products only through authorized channels and never to restock returned products.
Who Is Affected
Ledger recommended that users who purchased from CryptoBilis in the last 90 days not initiate setup if they have not done so yet. If users have already set up their Ledger device, the company advised them to consider moving assets to a new Ledger signer with a new seed phrase.
CryptoBilis issued an alert on its website stating that recovery phrases must be generated by the device during setup and written down by the user. The reseller warned that if a device came with a recovery phrase already printed or written on a card, users should treat the wallet as unsafe.
What should you do?
Ledger strongly advised users to never share their recovery phrase or PIN with anyone. The company stated that no one from CryptoBilis or Ledger will ever ask for these credentials. Users were also warned to be careful of anyone offering to recover lost funds, as these offers are almost always scams.
What to do and how to stay safe: Ledger
- Check if you purchased a Ledger device from CryptoBilis within the last 90 days.
- If you have not set up the device, do not initiate the setup process.
- If you have already set up the device, move your assets to a new Ledger signer with a new seed.
- Verify that your recovery phrase was generated by your device and written down by you during setup.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much money was stolen in the Ledger CryptoBilis incident?
The incident resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter.
Did Ledger find any physical tampering with the devices?
Yes, Ledger revealed that one of the impacted users' devices contained an unauthorized hardware implant.
What should I do if I bought a Ledger from CryptoBilis recently?
Ledger recommends users who purchased from this reseller in the last 90 days not to initiate setup if they have not done so yet.
