Key Takeaways
- • Ledger confirmed that a device belonging to one impacted user contained an unauthorized hardware implant, and said it is working with relevant authorities on the investigation.
- • Ledger declined to confirm the total amount lost, but blockchain investigator Specter estimated $86 million had been drained from devices; other researchers reportedly estimated $72 million to $86 million.
- • The compromised units were linked to Kuala Lumpur-based reseller CryptoBilis, which has stopped selling hardware wallets; Ledger has advised buyers from the reseller not to set up their devices.
- • Ledger described the number of affected products as "limited," but did not say how many of its signing devices contained the implant.
Summary
Ledger, the Paris-based hardware wallet manufacturer, said it is investigating reports that customers in Southeast Asia lost funds after buying devices from a reseller. According to Bitcoin Magazine, the company began its investigation on Friday, and on Saturday confirmed that one impacted user's device contained an unauthorized hardware implant. On Sunday, Ledger said it had contacted affected customers and was working with relevant authorities, while describing the number of impacted products as "limited."
The losses have been tied to CryptoBilis, a Kuala Lumpur, Malaysia-based vendor. Ledger advised customers who bought from CryptoBilis not to set up their devices, and said CryptoBilis has since stopped selling its hardware wallets. Ledger did not confirm the size of the losses. Blockchain investigator Specter put the amount drained from devices at $86 million. Social media users posted photos of devices they said had been modified to capture private keys, but it remains unclear how many Ledger signing devices contained the implant. Neither Ledger nor CryptoBilis immediately responded to Bitcoin Magazine's questions.
Ledger warned users not to buy from unauthorized resellers, citing the risk of counterfeit or modified devices that fall outside Ledger's security guidelines. The company said it would continue to review and strengthen its distribution and anti-tamper processes.
The incident comes amid heightened attention to hardware wallet security. Bitcoin Magazine noted that in July, hackers stole close to $120 million in bitcoin from Coldcard users, owing to a firmware bug in products made by Canadian company Coinkite that led to faulty seed generation. Separately, Trezor reported last month that close to 81,000 customers had their details leaked after a third-party fulfillment partner suffered a data theft. Scammers have also used data obtained through Ledger's payment processor, Global-e, to send phishing emails this year.
The losses have been tied to CryptoBilis, a Kuala Lumpur, Malaysia-based vendor. Ledger advised customers who bought from CryptoBilis not to set up their devices, and said CryptoBilis has since stopped selling its hardware wallets. Ledger did not confirm the size of the losses. Blockchain investigator Specter put the amount drained from devices at $86 million. Social media users posted photos of devices they said had been modified to capture private keys, but it remains unclear how many Ledger signing devices contained the implant. Neither Ledger nor CryptoBilis immediately responded to Bitcoin Magazine's questions.
Ledger warned users not to buy from unauthorized resellers, citing the risk of counterfeit or modified devices that fall outside Ledger's security guidelines. The company said it would continue to review and strengthen its distribution and anti-tamper processes.
The incident comes amid heightened attention to hardware wallet security. Bitcoin Magazine noted that in July, hackers stole close to $120 million in bitcoin from Coldcard users, owing to a firmware bug in products made by Canadian company Coinkite that led to faulty seed generation. Separately, Trezor reported last month that close to 81,000 customers had their details leaked after a third-party fulfillment partner suffered a data theft. Scammers have also used data obtained through Ledger's payment processor, Global-e, to send phishing emails this year.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.