Ledger confirms hardware implant in CryptoBilis-sold devices amid crypto theft probe

Traders Union
All News
Crypto
Ledger hardware implant incident

Highlights

Ledger confirms an unauthorized hardware implant in CryptoBilis-sold devices after the Oct. 9, 2026 crypto theft incident affecting customers in Indonesia, Malaysia, and the Philippines.
Estimated losses from the incident range from $86 million to $93 million stolen from over 300 wallets across Bitcoin, Ethereum, and Tron blockchains.
Ledger maintains its internal systems were not breached, urges use of approved distributors, and highlights industry-wide need for stricter anti-tamper and chain-of-custody standards.

Investigation centers on CryptoBilis distribution channel

As reported by CoinDesk, citing Ledger Support in statements released on Oct. 10 and Oct. 11, the company confirms that one impacted user's device contained an unauthorized hardware implant and says all confirmed cases in the Oct. 9, 2026 draining incident involve devices sold through CryptoBilis.

Ledger says it is actively contacting affected users as the investigation continues, while CryptoBilis has suspended sales of all hardware wallet inventory until the review concludes. The reseller operates in Indonesia, Malaysia, and the Philippines, where the incident first drew attention after reports of missing funds from customers who bought devices through that channel.

Ledger advises CryptoBilis customers not to initialize unused devices. Users who already set up affected wallets should move their funds to a new seed using a device obtained directly from Ledger.

Industry scrutiny grows over hardware wallet controls

The finding is the first evidence backing earlier speculation of supply-chain tampering in the case. Ledger says there is no indication that its own internal security infrastructure, systems, or services were compromised, and it is cooperating with relevant authorities.

While the company has not confirmed an official loss figure, third-party on-chain researchers estimate that $86 million to $93 million was stolen from more than 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. The episode is raising broader questions for the self-custody market, where investors rely on physical devices and secure distribution practices to protect digital assets.

Ledger says it is reviewing authorized reseller controls and is urging distributors to source products only through approved channels, while prohibiting the restocking of returned products. The company also says the incident reinforces the need for stronger anti-tamper and chain-of-custody standards across the hardware wallet industry.

Our earlier coverage of Tabung Haji’s cyberattack and system recovery explained how the institution temporarily suspended services on Oct. 8 to protect depositors, then restored core systems and reopened branches after security reviews and strengthened controls. It also noted that some THiJARI functions remained limited during recovery, while Tabung Haji worked with cybersecurity authorities and external experts and urged users to report any unusual transactions.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.