Hardware wallet manufacturer Ledger has confirmed that at least one device sold through CryptoBilis, a Southeast Asian reseller, contained an unauthorized hardware implant connected to ongoing cryptocurrency theft losses. The acknowledgment comes as independent investigators estimate that suspected thefts tied to the incident have reached approximately $93.2 million.
In an October 10 statement, Ledger said the discovery involved a device belonging to one of the affected customers, according to CryptoSlate. The company stated that confirmed cases related to the compromise are limited and emphasized that its own internal systems were not affected by the breach, CoinDesk reported.
CryptoBilis operates as a regional reseller distributing Ledger hardware wallets. The confirmation of a physical implant marks a significant development in the broader investigation into how funds were drained from users who had purchased devices through third-party channels rather than directly from the manufacturer. While hardware wallets are generally designed to keep private keys offline and resistant to remote attacks, a physical implant introduced during the supply chain or distribution process can potentially bypass those protections by exfiltrating secrets or tampering with transaction signing processes.
The $93.2 million figure stems from independent investigators tracking suspected thefts linked to the broader incident, CryptoSlate noted. Ledger’s October 10 disclosure did not independently confirm that specific loss total, but the company did verify the presence of the unauthorized component in at least one wallet traced back to CryptoBilis inventory.
Ledger has sought to draw a sharp distinction between the integrity of its manufacturing pipeline and the compromised units that apparently originated from the reseller channel. In its communications, the firm underlined that the tampered devices represent a limited set of cases and do not reflect a compromise of Ledger’s internal infrastructure, CoinDesk reported.
The incident has renewed scrutiny of supply-chain security for physical cryptocurrency storage devices. Reseller networks, particularly in regions with high retail demand, can introduce points of vulnerability if inventory is intercepted or modified before reaching end users. Security researchers have long warned that sophisticated attackers may target hardware wallets during shipping or distribution, installing implants that are difficult to detect without destructive analysis.
Ledger’s confirmation shifts the focus of the multi-million dollar theft investigation toward understanding how the unauthorized implants were introduced into CryptoBilis-sourced stock and whether additional devices from the same batch carry similar modifications. Users who acquired hardware wallets through unofficial or secondary channels are being urged to verify the provenance of their devices and to remain alert for any signs of tampering.
As investigators continue to trace the flow of stolen funds and assess the full scope of the compromise, Ledger’s finding establishes a concrete link between physical device tampering and the reported losses, framing the incident as a supply-chain attack rather than a flaw in the wallet’s underlying software architecture.