Timeline
- 8.0
Ledger User Reports Hardware Implant in Wallet Bought in Europe
User @0xJohannes reported that a Ledger hardware wallet bought weeks earlier from a European authorised reseller contained an unauthorised implant, with suspicious wiring that genuine Ledger devices do not have, indicating the device may have been physically tampered with before sale. Funds held on the affected device have not been stolen, and suspected cases have also been reported in Asia and South America. The report raises the possibility that the tampering scheme first disclosed on October 9 is not confined to the Southeast Asian reseller CryptoBilis that Ledger has identified, which is a concern for self-custody users who assume devices bought through normal retail channels are genuine. According to the user account, Ledger's Genuine Check cannot detect unauthorised physical modification when the original secure element remains intact. Ledger maintains that all confirmed fund-draining cases in its October 9 investigation involve CryptoBilis, a reseller in Indonesia, Malaysia and the Philippines, which has halted hardware-wallet sales. The reported implant appears to be an older version; newer variants typically conceal components behind the screen.
- 8.0
Ledger Says Affected User’s Device Contained Hardware Implant
Ledger has confirmed that an affected user's device contained a hardware implant, and reseller CryptoBilis has halted sales of its entire hardware wallet inventory — across all brands — pending the investigation. The move widens an earlier pause request that had been limited to Ledger devices. A confirmed implant inside a Ledger device sold through a reseller is a supply-chain compromise of a widely used self-custody product, directly putting recovery phrases and user funds at risk. Ledger has advised buyers from the past 90 days not to set up their devices and, if already set up, to consider moving assets to a new signer. Blockchain analytics firm Bitquery reported the incident drained $93.2 million from 315 wallets across six chains. CryptoBilis has suspended sales and shipments across all stores and online channels in Malaysia, the Philippines and Indonesia and closed its physical stores until further notice; company records show a 100% ownership change effective August 3 to a person named Jiaming with a registered address in Heilongjiang, China, after a March acquisition, though no evidence links the ownership change to the wallet thefts.