Ledger Confirms a Hidden Implant in Wallets Sold by a Reseller: How to Keep Your Crypto Safe

The case is a rare, real-world example of a "supply chain" attack, where a device is tampered with before it ever reaches the buyer.

Hardware wallets are supposed to be the safest way to store cryptocurrency. This week, one of the most popular makers admitted that some of its devices were tampered with before customers got them. Ledger confirmed that an "unauthorized hardware implant" was found inside a wallet bought by a customer whose funds were drained, and that all confirmed cases so far involved devices sold through CryptoBilis, a reseller in Southeast Asia.

What happened

On Friday, Oct. 9, Ledger said it was investigating reports of missing funds from CryptoBilis customers. On Oct. 10, it confirmed that one affected user's device contained the implant. In an update on Sunday, Oct. 11, Ledger said every confirmed case was tied to CryptoBilis, which sells Ledger wallets in Indonesia, Malaysia and the Philippines, and that its own systems and direct sales channels were not affected, according to CoinDesk.

Ledger has not confirmed a total loss figure. Independent on-chain researchers estimate that $86 million to $93 million was stolen from more than 300 wallets holding bitcoin, ether and Tron-based tokens. CryptoBilis has suspended sales of its hardware wallet inventory while the investigation continues. Ledger said it is cooperating with authorities, has told distributors to buy only through authorized channels and has banned restocking returned products.

What a hardware wallet does

A hardware wallet is a small device, often the size of a USB stick, that stores the private keys that control your crypto. Keeping keys offline makes them much harder for hackers to steal than keys stored on a phone or computer. When you set one up, it generates a recovery phrase, usually 24 words, that can restore your wallet if the device is lost. Anyone who gets that phrase can take your crypto.

A supply chain attack targets that trust. If someone modifies a device before it's sold, they may be able to capture the recovery phrase or keys, then drain the wallet later.

Ledger's advice

Ledger told users not to set up any unused devices bought through CryptoBilis. If a device from that reseller is already in use, Ledger advised moving funds to a new recovery phrase on a device bought directly from Ledger. It also urged affected users to contact official Ledger Support and file a complaint with local police. Ledger stressed that it will never call you, send direct messages or ask for your 24-word recovery phrase, so anyone who does is a scammer.

What this means for your wallet

The biggest lesson is to buy security devices only from the manufacturer or an authorized retailer. Avoid secondhand wallets, marketplace listings and deals that seem too good to be true. When a new wallet arrives, check that the packaging is sealed and that the device generates a fresh recovery phrase during setup. A wallet that arrives with a pre-printed phrase is a red flag.

Never type your recovery phrase into a website, app or email, and never share it with anyone, including people claiming to be from customer support. Store it offline in a safe place.

Finally, remember that crypto theft is usually unrecoverable. That's one more reason to keep crypto to an amount you could afford to lose, and to spread your savings across safer accounts too.

This article is for education only and is not financial advice. Everyone's situation is different.