Ledger says unauthorized implant found in at least one device sold by CryptoBilis

While Ledger has not confirmed an official loss, third-party on-chain researchers have estimated the loss at between $86 million and $93 million from more than 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. The company reiterated that it there is no indicattion that its own internal security infrastructure, systems, or services were compromised.

Ledger stated it is cooperating with relevant authorities on Sunday. The company also reminded its network of distributors to source products exclusively through authorized channels and strictly prohibited the restocking of returned products.

The company repeated its earlier security guidance to pcustomers who purchased devices via CryptoBilis: “Do not initialize unused devices. If already set up, move to a new seed on a device from Ledger.” The company urged affected users to contact official Ledger Support and file complaints with local law enforcement.

Ledger also warned that scammers often attempt to exploit incidents of this type, reminding users that the company will never call, DM, or ask for their 24-word recovery phrase.

When will wallets be SAFU?

The Ledger incident has again raised broader industry questions regarding hardware wallet safety. Following the 2022 collapse of the FTX exchange, millions of investors migrated their assets into self-custody, relying heavily on physical hardware wallets made by firms like Ledger and Coinkite (makers of Coldcard) to keep private keys entirely offline.