Hardware wallet manufacturer Ledger says it has found evidence that at least one affected device purchased through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant. The discovery comes as Ledger continues its investigation into reported crypto losses tied to specific devices distributed via the reseller.
In a Sunday post on X, Ledger confirmed it is contacting impacted users and urged anyone with relevant information to participate in its bounty program. The company also provided interim guidance for customers who bought Ledger hardware through the reseller.
Key takeaways
- Ledger confirmed that one compromised device contained an unauthorized hardware implant.
- Ledger says its infrastructure and services were not compromised, and the investigation is ongoing.
- CryptoBilis has paused sales of all Ledger hardware inventory until the investigation concludes.
- Ledger recommends users avoid initializing devices they havenโt set up, andโif already set upโmove funds to a new device and seed.
- Ledger has not publicly confirmed how many customers were affected or the total value of losses.
Ledger reports an unauthorized implant on an affected device
Ledgerโs confirmation centers on reports of funds being lost on devices purchased from CryptoBilis. According to Ledgerโs post on X (via its support account), the company is reaching out to users as part of its continuing investigation.
Investigator Specter, referenced in Ledgerโs update, has estimated losses across Bitcoin, Ethereum, and Tron could be greater than $86 million. Ledger, however, did not confirm the scope of losses or how many individuals were affected.
To help advance the inquiry, Ledger said it is inviting individuals with information related to the investigation to contact its bounty program at bounty@ledger.fr.
Precautionary steps for CryptoBilis buyers
Ledgerโs immediate customer guidance focuses on reducing the risk of further compromise.
For users who purchased a Ledger device from CryptoBilis but have not yet begun setup, Ledger recommends not initiating the deviceโs setup process if it hasnโt already been completed.
For users who already set up their Ledger device, Ledger advised moving assets to a new Ledger signer generated with a new seed phrase. The intent is to ensure any exposure linked to the affected device cannot continue to endanger funds.
Reseller pauses sales while Ledger investigates
In the same X update, CryptoBilis confirmed that it has stopped selling all hardware wallet inventory associated with the implicated period or stock, pending the outcome of the investigation. Ledger said it is in active communication with CryptoBilis regarding next steps.
Earlier reporting from Cointelegraph indicated that CryptoBilis appeared on Ledgerโs list of authorized resellers in Indonesia, Malaysia, and the Philippines. Ledger has not stated in the update how the compromise occurred or whether it was connected to any specific supply chain step beyond the reseller stock.
Ledger says its systems were not breached
While Ledger is dealing with reports involving compromised devices, it stresses that the broader ecosystem was not targeted.
In a statement provided to Cointelegraph, Ledger said the incident appeared isolated to the single reseller and its market, adding that โLedgerโs infrastructure, systems and services were not compromised.โ The company reiterated that its investigation remains ongoing.
For customers seeking help, Ledger directed users to contact customer support via official channels at http://support.ledger.com.
Readers should monitor further updates from Ledger and CryptoBilis for conclusions about which devices were affected and what remediation steps will be offered. The key open questions remain how widespread the issue is and exactly how the unauthorized hardware implant entered the devices sold through the reseller.
