Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.
On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter.
"We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," Ledger said in an X post. "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed)."
The company has since revealed that one of the impacted users' devices contained an unauthorized hardware implant, and that it's reaching out to impacted users as part of an ongoing probe into the incident. Out of an abundance of caution, CryptoBilis has ceased sales of all hardware wallet inventory until the investigation is concluded.
"Your recovery phrase must be generated by your device when you set it up, and written down by you," CryptoBilis said in an alert on its website. "If your device came with a recovery phrase already printed or written on a card or sheet, or if anyone other than you has seen your recovery phrase, treat your wallet as unsafe."
"Never share your recovery phrase or PIN with anyone. No one from CryptoBilis or Ledger will ever ask for them. Be careful of anyone who offers to recover lost funds; these offers are almost always scams."
In a follow-up update posted on October 11, 2026, Ledger acknowledged that the CryptoBilis incident has impacted a "limited" number of devices, adding all confirmed cases involve devices sold through CryptoBilis.
The company also advised resellers and distributors to source products only through authorized channels and never to restock returned products.
"Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines," it added.
Update
In an update shared on October 13, 2026, Ledger said it has not confirmed the total number of affected users or the total value lost following the incidents. It also described the hardware implant as designed to capture a victim's hardware wallet's seed phrase and use it to drain the assets -
The implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The findings corroborate a report from Tibane Labs, which detailed three different variants of the implant, each more advanced than its predecessor. The third generation is assessed to be the most sophisticated. It was purchased on Amazon Japan from a third-party seller based in China.
"The parcel was shipped from Malaysia," Tibane Labs said. "The route is worth noting: a listing on a mainstream marketplace, a seller in one country, a shipment from another, and nothing on the box to tell it apart from a genuine new device."
The Paris-based company has since disclosed that MediaMarkt Saturn has paused the sale of Ledger devices in their stores following the discovery of an implant from one customer in Germany. "No loss of funds were reported," it added.
As of writing, Ledger's website shows that sales of its devices have been temporarily paused through the following authorized resellers, although it's unclear if it's related to the same incident -
- CryptoBilis (Indonesia and Malaysia)
- Shopee Mall (Malaysia and the Philippines)
- LazMall (the Philippines)
Ledger has also shared a "Genuine Check" mechanism to determine the hardware integrity of the device. However, it has cautioned users to first take a backup of the recovery phrase, because opening a signer can damage it. It has also explicitly warned that "it cannot detect unauthorized physical modifications to the hardware" if the Secure Element remains intact.
"We have no indication that Ledger's infrastructure, systems or services were compromised," Ledger noted. "Ledger will never call you, message you directly, or ask for your 24-word recovery phrase."
Ledger Expands Pause of Third-Party Sales
Ledger, in an update shared on October 13, 2026, at 6:03 p.m. ET, confirmed it's asking resellers and distributors across Southeast Asia and Hong Kong to suspend the sale of Ledger devices and take them off the shelves as the investigation remains ongoing. Targeted countries include Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia, and Hong Kong.
"To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia," it said. "We have not verified a drain linked to a device bought elsewhere. The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened."
(The story was updated after publication to reflect the latest developments.)
