Ledger has confirmed that an unauthorized electronic component was found inside a customer wallet tied to Southeast Asian reseller CryptoBilis, marking the first confirmed physical evidence of tampering in an investigation into reported crypto thefts. The discovery was disclosed in an October 10 update, after customers in Indonesia, Malaysia, and the Philippines reported drained balances in early October 2026.
On-chain researchers including Specter and MistTrack have followed inflows from hundreds of victim addresses across Bitcoin, Ethereum, and Tron networks. Estimates of total losses range from roughly $70 million to just under $93 million, with the most commonly cited figure near $90 million. Ledger has asked CryptoBilis to pause sales and shipments, and warned buyers from the past three months not to set up newly purchased devices. Existing users were urged to move funds to a fresh wallet with a newly generated recovery phrase.
According to Ledger, the rogue hardware was designed to interfere with communication between internal wallet components and the display, rather than directly compromising the secure element that guards private keys. Such tampering could expose sensitive transaction details or manipulate what a user sees when approving transfers. Investigators have not yet determined how many devices were affected or whether the implant was the direct cause of all reported thefts.
Former Mt. Gox CEO Mark Karpelès separately examined photographs from affected customers and confirmed suspicious components. He later dismantled one part to study its capabilities. An earlier case involved a Ledger Nano X obtained in Malaysia where the rogue component was present despite apparently intact shrink-wrap packaging, deepening concerns about supply-chain interference before products reached buyers.
Records show CryptoBilis changed ownership earlier in 2026; by early August full control passed to an individual with a registered address in China's Heilongjiang province. The timing has fueled further debate about transparency in authorized reseller channels, although no public evidence yet connects the ownership shift directly to the compromised devices.
The incident follows a separate hardware wallet failure in 2026, when Coldcard devices from Coinkite were found to have a long-hidden seed generation flaw that allowed attackers to drain more than $100 million in Bitcoin. Together with September's Bitget breach, which drained about $387.5 million from hot and warm wallets, the latest Ledger case underscores that secure, convenient custody remains a critical unsolved problem for the crypto industry.
