Ledger confirms a customer's hardware wallet had an unauthorized implant inside, as losses tied to one reseller top an estimated $86 million

Ledger has confirmed that one of the hardware wallets at the centre of a wave of reported wallet drains in Southeast Asia was physically altered. In an update posted on X on Saturday, the company's support account said a device belonging to one affected user contained an unauthorized hardware implant, and that it is contacting others caught up in the case.

The devices were bought from CryptoBilis, which was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger said CryptoBilis has now stopped selling all of its hardware wallet stock until the investigation ends.

The confirmation covers a single device. Ledger has not said how many customers were hit or how much was taken, Cointelegraph reported. On-chain investigator Specter has estimated that losses may exceed $86 million across Bitcoin, Ethereum and Tron. What the implant did, and when it was fitted, has not been made public.

"We have no indication that Ledger's security infrastructure, systems or services have been compromised," the company said. It is working with authorities and thanked the security group SEAL 911 for its help.

Ledger's advice is unchanged: anyone who bought from this reseller should not set the device up, and anyone who already did should consider moving funds to a new Ledger with a new seed. The company says it is working on stronger anti-tampering protections, and warned that scammers exploit incidents like this. It will never ask for a 24-word recovery phrase.