Ledger wallet security risks emerge from CryptoBilis tampering incident

Ledger wallet security risks became evident after reports surfaced of tampered devices sold by authorized reseller CryptoBilis. On October 9, 2026, Ledger paused sales through that channel following user reports of drained funds. The issue affected a limited number of units in Indonesia, Malaysia, and the Philippines.

Ledger wallet security risks tied to supply chain tampering

Ledger confirmed on October 10 that an unauthorized implant had been placed inside at least one affected device. The implant used an LTE-enabled microcontroller with eSIM to capture the 24-word recovery phrase during setup and transmit it remotely. This component sat inside the enclosure without altering the Secure Element, Ledger OS, or transaction signatures, so the standard Genuine Check still passed.

Researchers traced on-chain activity linked to roughly 300 to 324 wallets, with estimates of losses ranging from 86 million to over 93 million dollars across Bitcoin, Ethereum, and TRON networks. Tether froze about 10 million dollars in related USDT. Ledger stated its own infrastructure and direct sales remained unaffected.

Users who bought from CryptoBilis in the prior 90 days received specific guidance. They were told not to initialize unused devices and to transfer any assets from initialized devices to a new Ledger unit with a fresh recovery phrase. Ledger expanded pauses to other Southeast Asia and Hong Kong distributors while updating reseller policies to prohibit restocking returns.

Actions taken by Ledger and reseller responses

Ledger's Donjon team examined sampled stock from other distributors and found no additional implants. The company began working with law enforcement, contacted affected users, and reviewed isolated reports of modified devices outside the region. CryptoBilis suspended all hardware wallet sales and closed stores in the affected markets. Former founders noted the company had changed ownership in March 2026, removing their operational control.

Other hardware wallet brands, including OneKey and Trezor, also ended or reviewed their relationships with CryptoBilis. Ledger announced development of new anti-tampering measures and introduced the Atom, an Android-based signer with enclosure and screen removal sensors powered by an independent battery. The Founders Edition carries a price of 849 dollars, with shipments planned for summer 2027 through official channels only.

Exact tampering location in the supply chain, total number of affected devices, and whether every reported drain resulted solely from implants remain under review. Ledger continues inspections and policy updates for resellers.

Practical steps for current Ledger users

Buyers should purchase only from Ledger's official website or verified authorized sellers listed on the company site. Anyone who received a device from CryptoBilis should follow the recovery instructions already issued. Running the Genuine Check remains useful but does not detect this type of external implant.

Users planning new purchases can wait for devices that include the upcoming tamper-detection features. Keeping recovery phrases offline and never entering them on connected devices reduces exposure even if physical tampering occurs. Ledger has not reported any similar incidents in its direct sales channel.