Ledger confirms hardware implant in reseller device as losses estimated at $86M

Hardware implant confirmed in reseller supply chain

Hardware wallet manufacturer Ledger confirmed that a device purchased from a Southeast Asian reseller contained an unauthorized hardware implant. The confirmation follows reports of cryptocurrency losses across Bitcoin, Ethereum, and Tron networks. Investigator Specter estimated that total losses may exceed $86 million. Ledger has not confirmed the total value of reported losses or the exact number of affected customers.

In a statement regarding the ongoing investigation, Ledger stated that its infrastructure, systems, and services were not compromised. The company indicated that the incident appears isolated to a single reseller and its market. Ledger is contacting users as part of its investigation and requesting anyone with information to contact its bounty program at [email protected].

Supply chain investigation at regional reseller

The affected devices were associated with CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines. CryptoBilis confirmed that it has ceased all sales of hardware wallet inventory until the investigation concludes.

Ledger recommended that customers who purchased a device from this reseller refrain from initial setup if they have not already done so. For users who have already configured a device bought from the reseller, Ledger advised considering moving assets to a new Ledger signer with a new seed phrase.

Ongoing investigation and customer guidance

Ledger is maintaining active communication with CryptoBilis while continuing its investigation. Customers seeking assistance or official guidance can contact Ledger customer support through official channels at support.ledger.com.