Ledger Warns CryptoBilis Buyers Over Tampered Wallets Amid $86M to $93M Loss
Key Summary
Ledger has issued a warning to buyers of its hardware wallets sold through CryptoBilis, advising them to stop using tampered wallets due to losses estimated between $86 million and $93 million. The affected wallets contain an unauthorized hardware implant that can capture a user's recovery phrase, prompting users to move their assets to a new Ledger with a brand-new recovery phrase.
Warning Issued for CryptoBilis Buyers
Ledger has a blunt message for anyone who bought a hardware wallet from CryptoBilis recently: do not trust that device. If it is still in the box, leave it uninitialized. If you already set it up, move your assets to a new Ledger with a brand-new recovery phrase.
Investigation Reveals Tampering
On October 9, 2026, Ledger ordered CryptoBilis, its Southeast Asian reseller, to stop all sales and shipments. The move came after reports that wallets bought through the distributor were being drained.
A day later, on October 10, Ledger confirmed that at least one affected device contained an unauthorized hardware implant. According to the company, every verified draining case traced back to a CryptoBilis purchase.
Implications Beyond One Distributor
The investigation is still developing on several fronts. Key open questions include how many devices carried implants, how the tampering got into the distribution chain, and whether authorities identify those responsible. The final loss figure may also shift as on-chain tracking continues.
Action for Affected Buyers
For anyone holding a CryptoBilis-sourced Ledger bought in the past 90 days, the to-do list is short and not optional. Do not initialize unused devices, get a new wallet, generate a new phrase, and move the funds.