Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports
Ledger pauses sales via CryptoBilis after reports of $86M fund theft linked to tampered hardware wallets.
Run Ledger?
Get an email when a reviewed story names Ledger, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Ledger has halted sales through reseller CryptoBilis due to reports of over $86 million in stolen funds from users in Southeast Asia. The company is investigating, and has confirmed one affected user's device contained an unauthorized hardware implant. Ledger advises users who purchased from CryptoBilis in the last 90 days to avoid setting up their devices or to move assets if already set up.
The lesson from this incident
Full lessonLedger hardware wallets sold through unauthorized or compromised reseller CryptoBilis were found to contain physical hardware implants, enabling attackers to steal over $86 million from users in Southeast Asia. This attack exploits the critical gap between manufacturer quality controls and third-party reseller channels, where tampered devices can reach end users without any visible signs of compromise. Unlike software-based attacks, hardware implants are extremely difficult for consumers to detect without specialized equipment, making supply chain integrity essential. This incident underscores that even security-focused hardware products are vulnerable when distribution channels are not rigorously vetted and monitored.
What helps against this
How we list vendors- Cyber asset inventory
You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.
- Third-party risk management (TPRM)
You know which suppliers could hurt you, and you hear quickly when one of them is breached.