Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device
Bitcoin Magazine Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device Ledger has reassured users after people who bought signing devices from a Malaysia-base...
Ledger has reassured users after people who bought signing devices from a Malaysia-based reseller reported losing funds.
Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.”
The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers.
Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller.
Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant.
Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices.
“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday.
It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”
Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis.
Ledger then advised customers who’d bought from CryptoBilis to not set up their devices.
CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday.
People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant.
Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine.
Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.
The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases.
In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen.
Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails.
Asanat Analysis — Why it matters
This incident underscores a critical vulnerability in hardware wallet distribution: the supply chain between manufacturer and end user. Ledger's devices are secure cryptographic tools, but their security model assumes the physical device received by the buyer is uncompromised. A reseller-level implant—whether hardware-based or firmware-modified—bypasses this assumption entirely. This mirrors historical precedents like the SolarWinds supply chain attack, where trust in intermediaries became the attack vector rather than the product itself.
For the hardware wallet ecosystem, this represents a sector-level reputation risk. Users already debate Ledger's closed-source firmware and Bluetooth implementation; a confirmed supply chain compromise feeds skepticism about centralized distribution. The investigation's outcome matters less than the signal it sends: hardware wallets remain only as secure as their distribution chain. This will likely accelerate adoption of alternative models (open-source firmware verification, direct-from-manufacturer purchases, self-custody education) and increase scrutiny of regional resellers across the industry.
The Malaysia-based reseller angle also highlights geographic arbitrage risks in crypto hardware—a common vector for counterfeit electronics in Southeast Asia. Users buying from unofficial channels to save 10-15% face implant or counterfeit risk that could drain entire portfolios. This strengthens the case for direct purchase-only policies, which Ledger will likely enforce more rigorously post-investigation.