Hardware wallet maker Ledger has confirmed unauthorized hardware inside a customerโs cryptocurrency wallet during the ongoing investigation into reported thefts involving CryptoBilis, a reseller operating in Indonesia, Malaysia, and the Philippines.
CryptoBilis has suspended all hardware wallet sales, while Ledger has advised customers who bought devices through the reseller not to set up their wallets and has recommended fresh recovery phrases for existing users.
Ledger Confirms Hidden Hardware In Customer Wallet
Ledger confirmed discovering an unauthorized hardware implant in a customerโs cryptocurrency wallet during its investigation into the CryptoBilis thefts. The hardware wallet maker confirmed the discovery in a statement, adding that the device in question belonged to an affected customer. The company posted on X, saying:
โSituation Update: Ledger can confirm that one of the impacted usersโ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledgerโs bounty program: bounty@ledger.fr. As a measure of precaution, CryptoBilis confirmed it has ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is in active communication with CryptoBilis on next steps.โ
However, Ledger has not disclosed the device model, how the unauthorized hardware was installed, or whether it transmitted any device information. Ledger also stated that its security team was investigating the incident and contacting affected users, but it did not confirm how many wallets were impacted.
Timeline Of Unauthorized Transactions
The first complaints of unauthorized transactions from customers who purchased Ledger wallets from CryptoBilis emerged on October 9. Ledger began an investigation following the complaints and asked CryptoBilis to suspend the sale of its devices. Ledger did not confirm any losses, but said it found no evidence that its internal systems, security infrastructure, or services were compromised.
โWe have no indication that Ledgerโs security infrastructure, systems, or services have been compromised.โ
An independent report by The Block claimed that on-chain investigators had pegged losses at over $72 million, while another estimate put losses above $86 million. Former Mt. Gox CEO Mark Karpelรจs reported a suspicious Ledger Nano X device from Malaysia on October 9. Karpelรจs said he found an additional component hidden behind the display, adding that the deviceโs packaging appeared intact.
Tibane Labs published a technical analysis of affected wallets, describing a microcontroller, cellular communication hardware, and connections to the displayโs internal data lines. Tibane Labs suggested that any device placed near the screen could capture information during wallet setup, potentially compromising the deviceโs recovery phrase.
CryptoBilis Suspends Hardware Wallet Sales
Meanwhile, CryptoBilis has temporarily suspended sales of its hardware wallet products, extending the pause beyond Ledger devices. The suspension will remain in effect until the investigation has concluded. Ledger is also in contact with CryptoBilis, and customers who purchased devices through the reseller have been advised not to set up their wallet.
The wallet maker has asked customers who have already configured their devices to move their crypto to a new hardware wallet and use a new recovery phrase. It has also asked users with information relevant to the investigation to contact security researchers at bounty@ledger.fr.
There are currently no suspects or arrests, and Ledger has not provided any information about when the investigation will conclude. Former CryptoBilis executives Arravind Prabu and Vimalatheethan said in a statement shared with Mark Karpelรจs and published by Tibane Labs that they had transferred operational control of the business following an ownership change earlier this year.
Millions May Have Been Lost On-Chain Researchers
On-chain analysts estimate that millions could have been lost from impacted wallets. Bitquery estimates that around $92.9 million was stolen from 311 wallets, exceeding earlier estimates between $72 million and $86 million. The firm attributed the difference to additional wallets and networks included in its analysis.
Bitqueryโs analysis identified $70.5 million in assets transferred from Tron wallets and another $16.8 million in Bitcoin (BTC). The firm argued that transfer activity matched that of an attacker who already controlled multiple wallets, and it identified several, adding that $10 million in USDT was frozen in several addresses linked to the thefts. It also flagged several transactions involving crypto swaps and transfers to Tornado Cash.
Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
