Ledger Wallet Tampering Investigation Raises New Questions About Crypto Self-Custody Security

Analysis

Ledger says an unauthorized hardware implant in devices sold through Southeast Asian reseller CryptoBilis captures recovery phrases during setup; on-chain researchers estimate tens of millions of dollars in thefts, but Ledger says those loss figures are unverified.

What Ledger has confirmed

On October 9, Ledger began investigating unauthorized transfers from wallets bought through CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines. Ledger asked the reseller to halt sales and shipments. It told customers who had bought through that channel in the past 90 days not to set up unused devices, and told those already using one to consider moving funds to a new signer generated from a new recovery phrase.

On October 10, Ledger said that one affected user's device contained an unauthorized hardware implant. On October 11, it said all confirmed cases involved devices sold through CryptoBilis, that its own systems and direct-sales channels were not compromised, and that it was cooperating with authorities.

Updated October 13: Ledger said analysis by its Donjon security team found that the implant captures the 24-word recovery phrase during device setup and transmits it over a mobile (LTE) connection using a provisioned eSIM. According to Ledger, the implant does not modify the device's Secure Element or operating system, and does not alter transactions or signatures. Ledger told victims to coordinate with law enforcement before opening an affected device. CryptoBilis has suspended hardware-wallet sales, according to CoinDesk.

What remains unconfirmed

Loss figures are third-party estimates. On-chain researcher Specter estimated losses above $86 million across Bitcoin, Ethereum and Tron; other on-chain estimates range from roughly $72 million to $93 million, across about 300 wallets. Ledger said on October 13 that "figures circulating online come from third parties and Ledger has not fully verified them." Ledger has not confirmed a total loss, the number of affected customers or how many devices were modified.

On October 13, MediaMarkt Saturn suspended Ledger sales in Europe after a customer in Germany reported an implant; Ledger said no funds were lost in that case. Whether that unit is connected to the CryptoBilis channel has not been established.

Why it matters

Hardware wallets are meant to protect private keys from compromised phones and computers. According to Ledger's analysis, this attack did not break the security chip; it added hardware that captured the recovery phrase before the chip could protect it. That makes device provenance and setup part of the security model, not just the cryptography.

Finding an implant does not prove that every reported theft used it, or that other Ledger products or other hardware-wallet brands were compromised. The risk is not confined to one manufacturer or blockchain: provenance and recovery-phrase protection matter whether the assets are BTC, ETH, XRP, stablecoins or other tokens.

Causal chain: security and market transmission

Reported attack pathway (per Ledger; scope not fully established): untrusted distribution channel → implanted device → recovery phrase captured at setup and sent over LTE → unauthorized transfers → losses and reduced confidence in that channel.

Possible industry response (forward-looking): supply-chain concerns → retailer and reseller suspensions → demand for provenance checks and tamper detection → stronger setup and recovery controls → more scrutiny of self-custody and institutional custody.

The evidence is a wallet-security incident, not a failure of the underlying blockchains or evidence of a market-wide selloff.

Related but separate incident: DCENT software wallets

In September, DCENT disclosed unauthorized transfers affecting users of its App Wallet software-wallet mode. DCENT says it has not confirmed a compromise of its dedicated hardware wallets, but warns that any hardware wallet whose recovery phrase was also imported into the affected software wallet may be at risk. The two incidents have different reported exposure paths; both turn on where recovery phrases are created and entered.

What AA is watching

Independent technical verification of Ledger's implant analysis.

How many devices were modified, and how they entered distribution.

An independently reconciled loss estimate and affected-wallet count.

The outcome of reports outside Southeast Asia, including Germany.

Law-enforcement and blockchain-forensics findings, and provenance changes by manufacturers, retailers and custodians.

Sources and verification

Ledger Support — hardware-implant update (October 10) — official statement, as quoted by CoinDesk.

Ledger Support — initial CryptoBilis investigation and customer guidance (October 9) — official statement, as reported by The Block.

The Block — Ledger confirms hardware implant; MediaMarkt suspends sales in Europe (October 13) — Donjon findings, Ledger's statement on unverified loss figures, victim guidance.

CoinDesk — Ledger says unauthorized implant found in at least one device sold by CryptoBilis (October 12) — Ledger's October 10–11 statements, CryptoBilis suspension, researcher estimates.

The Block — Ledger investigates CryptoBilis-linked losses (October 9) — initial guidance and on-chain loss estimates.

DCENT — September App Wallet security advisory and App Wallet vs. hardware-wallet mode FAQ .

Ledger's and DCENT's statements describe each company's own findings. Loss figures are third-party estimates, not confirmed totals.