Ledger Says Criminal Group Implanted CryptoBilis Wallets

Ledger says a criminal group fitted hidden hardware components into genuine wallets sold through Malaysian reseller CryptoBilis, capturing recovery phrases and enabling more than $90 million in estimated thefts. Customers began reporting missing funds on Oct. 9, and Ledger’s account, reported by Bloomberg, marks a shift from an unexplained run of wallet drains to a suspected physical attack on devices before they reached buyers.

Blockchain researchers estimated losses above $90 million, Bloomberg reported; Ledger has not confirmed a total. The distinction matters: the estimate describes funds traced by outside researchers, while the company’s investigation focuses on how affected devices were altered and distributed.

How did the implant expose the recovery phrase?

Ledger says its security team found an unauthorized component that captured the phrase displayed during device setup. According to the company’s incident response, the attackers bought genuine Ledger devices, opened them, added custom components designed to capture recovery phrases, then returned the devices to distribution through Southeast Asian resellers.

A recovery phrase can restore access to a wallet, so capturing it can give an attacker a route to the assets controlled by that wallet. That makes the setup process central to the reported mechanism: the implant targeted information displayed by the device, rather than needing to break into Ledger’s online systems. Ledger says its chip, operating system and servers were not compromised, and describes the incident as an attack on distribution after devices left its control.

How does this differ from the initial reports?

When users first reported losses on Oct. 9, the cause was not established publicly. The later finding adds a physical tampering mechanism and a distribution link to CryptoBilis, which Bloomberg identified as a focal point of the investigation. The retailer’s Kuala Lumpur store was reported closed on Oct. 13, with a notice saying its physical stores were temporarily shut.

The mechanism differs from a remote software intrusion: Ledger says the implant was fitted into devices before sale and targeted the recovery phrase during setup. It also differs from a compromise of Ledger’s own systems. Ledger says it found no compromised units in samples examined from its own stock, warehouses and other stores, and says its systems and direct sales channels were unaffected. Those findings narrow what is confirmed so far; they do not establish that every device sold through CryptoBilis was altered or explain how many users were affected.

Hardware wallets are intended to keep private keys offline, but the incident shows that a device’s route to the buyer can matter alongside its software and hardware design. Buying directly from the manufacturer removes the particular reseller exposure Ledger has identified in this case, while reseller distribution can provide local access. Ledger’s response says it has asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales, screened stock, and is working with law enforcement and security researchers. These steps address distribution and detection; Ledger says it will share further technical details when it can.

What should buyers and the industry watch next?

The next signals are whether investigators identify additional affected devices or distribution points, whether authorities trace the stolen funds, and whether Ledger publishes a fuller technical disclosure. The company says buyers with unused devices should not initialize them and should contact Ledger Support; users who already set up a potentially affected device should move assets to a new device with a newly generated recovery phrase. The loss estimate, confirmed victim count and scope beyond the reported CryptoBilis cases remain unresolved.

Sources and documents

• Bloomberg — news.bloomberglaw.com
• incident response — support.ledger.com