Ledger is investigating reports of fund losses tied to hardware wallets distributed by a third-party Southeast Asian reseller, the company has clarified. According to Bitcoin Magazine, people who purchased signing devices from the Malaysia-based reseller reported losing funds after an implant was found in at least one device. The wallet manufacturer has since stated that its own direct sales channel and internal systems remain secure.
In statements issued on October 12, Ledger identified the reseller as CryptoBilis. Decrypt reported that every confirmed case is tied to devices sold by CryptoBilis and that the reseller has stopped selling hardware wallets. The company emphasized that users who bought directly from Ledger are not affected by the incident, drawing a clear line between its official store and the third-party vendor.
The financial scope of the drain remains under active tracing. CoinDesk noted that on-chain tracing has linked as much as $93 million to the scheme, while $10 million has already been frozen. Separately, Decrypt cited a suspected $87 million drain. Ledger has described the cases as limited, asserting that the impact is confined to the reseller's customer base rather than the broader user pool.
Despite the limitation in scope, the breach has intensified scrutiny over supply-chain security for physical signing devices. CoinDesk highlighted criticism that Ledger must answer for an authorized sales channel, given that customers purchased what they believed to be legitimate products through an approved reseller. The discovery of a physical implant in a device sold by the Malaysia-based entity raises specific questions about tampering procedures between manufacturing and end-user delivery, particularly because buyers relied on the reseller's authorized status.
The incident also marks a rare instance where a hardware compromise at a regional distribution partner allegedly enabled large-scale theft. Because Ledger devices are designed to keep private keys offline, any physical alteration during transit or at the point of resale undermines a core security premise. The finding that an implant was discovered inside a unit purchased through an official sales channel has prompted calls for tighter controls over how wallets are stored, handled, and authenticated before reaching end users.
Ledger’s reassurances have repeatedly centered on a sharp distinction between its primary marketplace and the third-party reseller. Both Decrypt and CoinDesk reported that Ledger maintains its own systems were not compromised and that direct purchasers face no elevated risk. With CryptoBilis no longer selling hardware wallets, the investigation continues to focus on how the devices were altered before reaching customers and the full path of the diverted funds across the on-chain ecosystem.