Ledger confirmed investigators discovered an unauthorized hardware implant in one affected user’s wallet, according to the company.

Scope and attribution

All affected devices were purchased from CryptoBilis, which serves as Ledger’s official reseller in Indonesia, Malaysia and the Philippines.

On-chain researchers identified wallets tied to thefts, and analytics firm Specter estimated combined losses could exceed $86 mln in BTC, ETH and Tron.

Ledger stated it is not publishing exact figures for the number of victims or the total value stolen, and it characterises the incident as limited to a single reseller and its markets.

Company recommendations

Ledger advised specific actions for customers who obtained devices from the implicated reseller to mitigate further losses and secure remaining funds.

• Do not set up a device purchased from CryptoBilis if it has not yet been initialized.
• If a compromised device is already in use, transfer assets to a new Ledger device and generate a new seed phrase immediately.

Reseller response and investigation

CryptoBilis suspended sales of all hardware wallets pending the outcome of the ongoing investigation, according to public statements attributed to the company.

Ledger emphasised that its own infrastructure was not breached and that the incident appears confined to the reseller’s supply chain and local distribution channels.