The hardware-wallet maker said it is contacting affected users and working with authorities as it investigates reported losses linked to devices purchased through CryptoBilis. Onchain investigator Specter has estimated that suspected losses across Bitcoin, Ethereum and Tron may exceed $86 million, although Ledger has not verified that figure or disclosed how many customers are affected.
Ledger said it has no indication that its own security infrastructure, systems or services were compromised.
What Has Ledger Actually Confirmed?
The most important new finding is limited but material: Ledger has examined an affected customer’s device and found an unauthorized hardware implant inside it.
The company has not publicly described the implant’s functionality, disclosed which Ledger model was affected or established when the modification occurred. It also has not said that every reported loss involved similarly altered hardware.
That distinction matters. Ledger’s initial investigation into CryptoBilis-linked losses had not established whether devices were counterfeit, physically modified or compromised through another mechanism. Confirmation of a modified unit now provides direct evidence that at least one customer received hardware that differed from Ledger’s authorized design.
Ledger has asked anyone with information relevant to the investigation to contact its bounty program and said it is cooperating with authorities. The company also credited crypto-security response group SEAL 911 with assisting the investigation.
Investor Takeaway
A confirmed implant shifts the risk toward the physical supply chain, but one tampered device does not establish the scope or mechanism behind every reported loss.
How Broad Is the CryptoBilis Sales Halt?
CryptoBilis has now stopped sales of all hardware-wallet inventory while the investigation continues, widening an earlier precaution that focused specifically on Ledger devices.
The reseller has operated in Indonesia, Malaysia and the Philippines and had been listed as an authorized Ledger reseller. Ledger remains in contact with the company about the investigation and next steps.
Customers who purchased a Ledger device through CryptoBilis but have not initialized it are being advised not to begin setup. Users who already configured a device should consider transferring their assets to a new Ledger signer initialized with an entirely new recovery phrase.
That guidance is important because simply moving funds to another account derived from the same seed would not solve the problem if the original recovery phrase had been exposed during setup.
Why Is Physical Tampering Particularly Dangerous?
The value proposition of a hardware wallet rests on isolating private keys and recovery information from internet-connected computers. That model assumes the user receives a trustworthy device before generating the seed phrase.
A compromised supply chain can attack that assumption before normal hardware-wallet protections become relevant. If unauthorized components or altered firmware can interfere with seed generation, display or signing, the customer may unknowingly begin using credentials that are already exposed.
The risk is not purely theoretical. Earlier this year, a counterfeit Ledger Nano S Plus purchased through a Chinese marketplace was found to have been physically and digitally modified in an apparent attempt to capture recovery information.
The CryptoBilis investigation is different because it involves a reseller that had been recognized within Ledger’s distribution network. That makes provenance, inventory custody and anti-tampering controls more important than simply telling users to avoid obviously unofficial sellers.
Investor Takeaway
Hardware security depends on distribution integrity. A legitimate device architecture cannot protect a seed if the product is modified before it reaches the buyer.
Is the $86 Million Loss Figure Confirmed?
No. Specter has estimated that more than $86 million may have been lost across Bitcoin, Ethereum and Tron addresses connected to the investigation, but Ledger has not confirmed either the amount or that every traced wallet belongs to an affected CryptoBilis customer.
Other investigators have published different totals, reinforcing the need to separate observable blockchain movements from confirmed victim losses. Addresses can be clustered incorrectly, transactions may overlap between researchers and not every transfer from a suspected wallet necessarily represents a theft.
Ledger has therefore stopped short of assigning a total financial impact while it identifies affected users and examines devices.
What Should Ledger Users Watch Next?
The next decisive findings will be whether Ledger identifies the implant’s function, determines where in the distribution chain devices were modified and establishes how many units may have been affected.
The company said it is working on stronger anti-tampering protections. Supply-chain security has already been a recurring issue across the hardware-wallet sector, while earlier Ledger-related incidents have shown how weaknesses outside a wallet’s secure element can still expose users.
For now, Ledger says the evidence remains concentrated around CryptoBilis rather than its broader device population or internal systems. The confirmed implant makes physical tampering a proven part of the investigation, but the size of the affected inventory, the precise theft mechanism and the final customer losses remain unresolved.
