Ledger Hardware Implant Confirmed In One Device Tied To CryptoBilis

A Ledger hardware implant is now confirmed in at least one device, according to Ledger itself. The company said on October 10 that one affected user's device contained an unauthorized hardware implant. The statement came from the company's verified Ledger Support account on X at 17:09 UTC. It is the first Ledger statement in this case to mention a physical modification of a device.

What the Ledger hardware implant statement says

The post says Ledger is reaching out to impacted users as part of an ongoing investigation and asks anyone with information to contact its investigators. The Defiant, which read the full text, reports one more line from the statement. Ledger said it has no indication that its own security systems or services were compromised. The update did not name the device model or explain how the implant worked. Its role in the reported losses remains open. A hardware implant is a physical change to a device, and the post does not say whether the same change appears in any other unit.

Ledger Support's October 10 update on X.

What came before it

The investigation began a day earlier. On October 9 at 13:32 UTC, Ledger Support wrote that it was looking into reports of lost funds from users in Southeast Asia who bought from a reseller named CryptoBilis. As a precaution it asked the reseller to pause all sales and shipments of Ledger devices.

The Defiant says CryptoBilis has since confirmed it stopped selling every device in its inventory, which goes further than Ledger's original request. Buyers from the past 90 days were told not to begin setup if they had not already. Those who had set up a device should consider moving assets to a new Ledger device with a new seed.

The loss figures are estimates

Nobody has confirmed a total. On October 9, onchain analyst Specter posted a trace of theft addresses that put combined losses above $86 million across Ethereum, Tron and Bitcoin. Other trackers cited by trade outlets landed between roughly $72 million and $90 million, and The Block's report noted that Ledger had not confirmed any figure.

Those numbers describe what investigators traced. They do not show how any single victim lost funds, and Ledger's implant finding covers one device only.

Ledger Support's first statement on the CryptoBilis reports, posted October 9.

What readers can check about the Ledger hardware implant

Ledger's own posts are the primary record here, and the Ledger hardware implant finding rests on the second of them. Compare any claim you see online against the two Ledger Support posts above, since several secondary accounts have added details Ledger has not confirmed.

Ledger repeated its standing warning that it will never ask for a 24-word recovery phrase, and it credited SEAL 911 with supporting the work. The recovery phrase rule is documented in the company's academy guide. Anyone who bought a device through this reseller should treat Ledger's official channels as the only source for next steps.