Bitcoin Magazine

Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users

Ledger has issued a statement following reports from customers of loss of funds and tampered devices, calling it one the most “sophisticated attacks” the digital asset industry has experienced. 

The hardware manufacturer said Thursday that a “highly organized criminal group” bought Ledger devices and installed implants that could read users’ seedphrases before then putting them back into the supply chain via resellers. 

Paris-based Ledger last week said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller, CryptoBilis. 

The company then said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant. 

It isn’t clear how much money has been lost from the tampered devices but blockchain investigator Specter said $86 million had been drained. Ledger did not respond to Bitcoin Magazine’s written questions. 

“[The criminal group] built their own logistics and technology infrastructure with seeds collector servers, draining and laundering infrastructures. They were patient, they spent millions, and they struck in one coordinated operation, draining wallets,” Ledger said in a Thursday statement. 

“There was no flaw in Ledger’s chip, operating system or servers. Ledger’s systems were not compromised. This was an attack on the distribution channel after the devices left our control.”

The company said that in its “largest investigation to date” it sent employees to other markets — including Europe — to make sure other supply chains hadn’t been targeted. 

It said that screened devices were clean and authorized resellers and distributors in Southeast Asia and Hong Kong have suspended their sales. 

Ledger added that it was working with law enforcement to “follow the funds and dismantle the attackers’ infrastructure.”

It isn’t clear how many customers had been targeted from Ledger’s statement. 

The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users.  

There have also been a number of data breaches this year, with scammers targeting Ledger to get customer information via the company’s payment processor Global-e.

This post Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device

Ledger has said it is working with authorities after users last week reported losing funds and one received a tampered device. But the company reassured customers that the number of impacted products was “limited.” 

The hardware wallet manufacturer added in an announcement on Sunday that it had reached out to affected customers. 

Paris-based Ledger on Friday said it had started an investigation after customers in South East Asia reported they’d lost funds after buying from a reseller. 

Then, on Saturday, Ledger said it confirmed that one of the impacted users’ devices contained an unauthorized hardware implant. 

Ledger would not confirm the amount of money lost but blockchain investigator Specter said $86 million had been drained from devices. 

“As the investigation continues, we are working with relevant authorities,” Ledger wrote on Sunday. 

It added: “Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.

“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.”

Customers in South East Asia last week reported losing funds after buying from Kuala Lumpur, Malaysia-based vendor CryptoBilis. 

Ledger then advised customers who’d bought from CryptoBilis to not set up their devices. 

CryptoBilis has since stopped selling its hardware wallets, Ledger said on Sunday. 

People on social media posted picture evidence of devices implanted into Ledger products, claiming it could get users’ private keys. It isn’t clear how many of Ledger’s signing devices contained the implant. 

Neither Ledger nor CryptoBilis immediately responded to questions from Bitcoin Magazine. 

Hardware wallet security has been a hot topic ever since hackers in July were able to steal close to $120 million in bitcoin from Coldcard users. 

The products, made by Canadian company Coinkite, contained a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails. 

This post Ledger Investigates Fund Losses Tied to Southeast Asian Reseller After Implant Found in Device first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Bitcoin Magazine

Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses

Hardware wallet manufacturer Ledger has said that it is investigating loss of user funds after customers in South East Asia reported issues with devices bought from a reseller. 

The Paris-based company on Friday advised customers who’d bought from vendor CryptoBilis within the last 90 days to not set up their devices. 

Ledger did not reveal how much money users had lost but one blockchain investigator, Specter, wrote on X that he’d traced theft addresses following social media posts and that over $86 million had been lost. 

BREAKING: Ledger reports loss of funds from users in South East Asia who purchased products from the reseller "CryptoBillis".

The situation is ongoing and users are urged to review Ledger's official updates. pic.twitter.com/0GT3cthQtD

— Bitcoin Magazine (@BitcoinMagazine) October 9, 2026

The issue comes following a number of data breaches this year in the crypto world and a huge hack of popular Coldcard hardware wallet devices in July. 

“Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis,” Ledger said via its support X account. 

Ledger added that it had asked CryptoBilis to pause all sales and shipments of Ledger devices.

“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses,” the company said. 

In a statement to Bitcoin Magazine, Ledger said that based on the information to date, the incident is isolated specifically to this reseller in this specific market. 

“No reports were made of products purchased directly from Ledger, and Ledger’s infrastructure, systems and services were not compromised,” the company added. 

CryptoBilis is a Kuala Lumpur, Malaysia-based hardware wallet vendor, according to its website. The company did not immediately respond to questions from Bitcoin Magazine. 

The crypto industry is still reeling after hackers in July were able to steal close to $120 million in bitcoin from Coldcard users. 

The products, made by Canadian company Coinkite, had a firmware bug which led to faulty seed generation, allowing hackers to essentially guess investor seedphrases. 

Galaxy Research said in the months following the attack various attackers were able to exploit the bug independently. 

In a separate incident, hardware wallet manufacturer Trezor last month reported that close to 81,000 customers had their details leaked after its third-party fulfillment partner had data stolen. 

Criminals have been targeting data this year, with scammers getting hold of customer information via crypto wallet Ledger’s payment processor Global-e to send phishing emails. 

This post Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Galaxy Research linked a suspected Bitcoin theft of 1,367.05 BTC to weak COLDCARD seeds. Coinkite says updates cannot repair seeds already generated on devices.