Ledger has warned customers not to buy or activate its hardware wallets from Malaysian electronics reseller CryptoBilis after compromised devices reportedly helped hackers drain users’ crypto holdings. The attack involved a physical implant that monitored the wallets’ buttons and e-ink screens, rather than just malicious software.
The thefts prompted Ledger, which specializes in secure blockchain wallets, to investigate. After examining several devices, the company concluded that the compromised wallets came from CryptoBilis. Where the reseller obtained them remains unknown, and the available account does not establish who installed the implants.
Ledger asked the reseller to halt distribution. “As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices,” the company said in a statement on X.
According to Bleeping Computer’s reporting, the implant was designed to monitor inputs from each wallet’s onboard buttons and changes on its e-ink screen. That data reportedly allowed it to identify the use of a seed phrase, a sequence of words used to generate static wallet addresses on the blockchain, and transmit the phrase to hackers using an eSIM.
A number of Ledger users reportedly had their wallets drained by the implants. The available account gives neither an exact number of affected users nor a total value for the stolen crypto.
Ledger’s position is that it and its services remain uncompromised, saying it has “have no indication that Ledger’s security infrastructure, systems or services have been compromised”. The distinction matters: the reported attack involves physically altered devices reaching customers through a reseller, not an established breach of Ledger’s underlying systems.
Futurism’s criticism, however, centers on the gap between devices advertised as having “industry leading” security and oversight of the supply chain that delivers them. Digital protections cannot answer the separate question of whether someone has added hardware that watches what a user enters and reads on the screen.
Ledger traced the compromised wallets to CryptoBilis, but where the reseller obtained them and who installed the implants remain unknown. The investigation has identified a sales channel, not the point where the devices were physically altered.
