Ledger confirms a hidden hardware implant in a drained wallet bought from Southeast Asian reseller CryptoBilis; losses estimated up to $93M

Ledger/Ledger signers (Nano, Flex, Stax) & Ledger Wallet

After users reported Ledger wallets drained across Bitcoin, Ethereum, Tron and stablecoins, the cases were traced to devices sold by CryptoBilis, an authorized reseller in Southeast Asia, and Ledger confirmed that at least one contained an unauthorized hardware implant. Analysts describe a hidden circuit board with cellular parts that reads the recovery phrase from the screen at setup. Ledger says its own systems were not compromised.

• Onchain investigators' loss estimates range from about $72M to $93.4M; one counts 471 addresses. Ledger has not confirmed the figure.
• CryptoBilis suspended all hardware wallet sales; Ledger is working with law enforcement.
• Ledger told buyers not to set up such devices and to move funds to a new signer with a new phrase.
• The attack targets the backup phrase at setup, not the secure chip; Ledger says it is working on stronger anti-tampering.