Ledger Warns Users of Tampered CryptoBilis Wallets After Major Security Breach

Ledger has issued a strong warning to customers who purchased hardware wallets from its Southeast Asian reseller, CryptoBilis, urging them to cease using these devices immediately. The caution follows investigations revealing that wallets sold through CryptoBilis were tampered with, leading to estimated losses between $86 million and $93 million across hundreds of wallets.

On October 9, 2026, Ledger ordered CryptoBilis to halt all sales and shipments after reports surfaced of wallet drains. The following day, Ledger confirmed that at least one affected device contained an unauthorized hardware implant capable of capturing users' recovery phrases during setup without compromising the device's secure element. This tampering affected wallets across multiple networks, including Bitcoin, Ethereum, and TRON.

CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines, has since suspended all sales activities while the investigation continues. Ledger is reviewing its reseller protocols and anti-tampering measures, emphasizing that its direct sales channels remain unaffected.

Customers who purchased a CryptoBilis-sourced Ledger wallet within the last 90 days are advised to avoid initializing unused devices, create a new wallet, generate a new recovery phrase, and transfer their funds to ensure their assets remain secure.

In light of the incident, Ledger has also requested other resellers in Southeast Asia, including those in Singapore, Thailand, and Vietnam, to suspend sales of its devices as part of ongoing efforts to trace the source of the tampering.