Beveiligingsbedrijf Yfarmx schat de schade op 93,4 miljoen dollar over 471 adressen. Wat moeten kopers van een Ledger nu doen?

Ledger said it has asked CryptoBilis to halt all the sales and shipments of Ledger devices while it investigates the reports of exploit.

Ledgerは、CryptoBilis経由で販売されたウォレットデバイスから不正なハードウェア改ざんを確認。資金流出報告により、同リセラー経由の販売を一時停止。ハードウェアウォレットの調達元確認が重要。

Ledger has confirmed that a cryptocurrency hardware wallet linked to reported fund losses contained an unauthorized hardware implant, bringing physical tampering into its investigation of devices sold through Southeast Asian reseller CryptoBilis. The finding raises supply chain security concerns, but Ledger has not confirmed how the implant worked or whether it caused every reported theft. In an October 10 statement , Ledger Support said, “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” CryptoBilis has stopped selling all hardware wallets while the investigation continues, and Ledger is contacting affected customers. The company’s October 11 update said all confirmed cases connected to the October 9 draining incident involved devices sold through CryptoBilis. Ledger described the number of affected devices as limited and said its own systems and direct sales channels remained unaffected. It is also working with relevant authorities. 72 hour update on reseller CryptoBilis incident As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.… — Ledger (@Ledger) October 11, 2026 The investigation began after customers reported missing cryptocurrency from wallets associated with devices purchased through CryptoBilis, which serves Indonesia, Malaysia, and the Philippines. Blockchain investigator Specter estimated possible losses above $86 million across Bitcoin, Ethereum, and Tron. That figure has not been independently confirmed, and Ledger has not established a final loss total. Hardware Implant Raises Supply Chain Concerns Hardware wallets normally keep private keys offline, reducing exposure to malware on connected computers. A physical implant creates a different risk because an added component could target information displayed during setup rather than attack the wallet’s core security system. Security researcher Mark Karpelès described suspected implants that monitor the wallet screen and send the recovery phrase through a cellular connection. Reported components include a small circuit board, a microcontroller, an antenna, an LTE chip, and an eSIM. These findings remain researcher observations, not a complete technical explanation confirmed by Ledger. A recovery phrase allows someone to restore a wallet and control its funds. If an attacker captures that phrase during setup, they may not need continued access to the original device. Earlier reporting on fake Ledger apps targeting macOS users shows how criminals also seek these secrets through software tricks. PoisonSeed phishing campaigns have similarly used false wallet upgrade pages to collect recovery phrases. A separate post by Johannes claimed a modified device had been bought from an official reseller in Europe. The account said that wallet had not lost funds. This claim has not been confirmed by Ledger and should not be treated as proof that the confirmed CryptoBilis incident extends beyond its stated scope. Ledger advises CryptoBilis buyers not to initialize unused devices. Customers who already completed setup should move assets to a new device purchased from Ledger and use a newly generated recovery phrase. Reusing the old phrase would not address the risk of that phrase already being exposed. Affected users should contact official Ledger Support and report suspected theft to local law enforcement. Ledger also warned that scammers may exploit the incident and said it will never call, send direct messages, or request a customer’s 24-word recovery phrase. The company is reviewing reseller controls and hardware protections. It has reminded distributors to buy only through authorized channels and never restock returned products. The investigation still needs to establish where tampering occurred, how many devices were modified, and which losses are directly connected to the confirmed implant. Ledger has not publicly identified who installed the unauthorized hardware component. Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup into your SOC The post Ledger Confirms Unauthorized Hardware Implant in Crypto Wallet Sold by CryptoBilis appeared first on Cyber Security News .

Ledger has confirmed that some of its devices distributed through Southeast Asian reseller CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets.

Ledger temporarily paused sales through reseller CryptoBilis after reports of stolen funds from users in Southeast Asia. Pseudonymous investigator Specter […]

Southeast Asian Ledger users who purchased hardware wallets from reseller CryptoBilis are reportedly being drained for millions.

Ledger vond een verborgen onderdeel in een wallet van CryptoBilis. Schade volgens een onderzoeker: meer dan 86 miljoen dollar. Wat moet je nu doen?

Ledger says it found an unauthorized hardware implant in at least one device tied to CryptoBilis, prompting the reseller to suspend hardware wallet sales and Ledger to advise affected customers on next steps.

Ledger’s confirmation that it found an unauthorized implant in at least one device sold through CryptoBilis is more than a

Ledger has asked Southeast Asian reseller CryptoBilis to suspend sales and shipments of its hardware wallets while it investigates reports of missing cryptocurrency. Its October 9 warning gives different precautions for customers depending on whether they have already set up a…