An unknown number of Ledger crypto wallet users have reportedly lost funds after tampered hardware was sold through the reseller CryptoBillis, and investigators suspect a spy implant is behind the thefts. Ledger has told CryptoBillis to halt all sales of its wallets while an investigation proceeds. The company has confirmed that a device belonging to one affected user held an unauthorized hardware implant.
Images and videos circulating on X and Threads appear to show a small circuit board hidden beneath the wallet's screen. According to the reports, the implant captures whatever appears on the display, including the seed passphrase presented during initial setup. An embedded SIM card then transmits that data to the attacker, who can use it to drain the user's accounts. The seed passphrase allows full control of a wallet, so its exposure would give an attacker direct access to funds.
The alleged campaign has drawn more than $86 million in crypto from hundreds of wallets, according to the reports. The evidence so far points to a supply chain attack, a category of intrusion in which hardware is compromised before it reaches the buyer. There is no indication that Ledger's own systems were breached, and wallets bought directly from the company have not been linked to the problem. The affected users appear to be concentrated in Southeast Asia and to have purchased through CryptoBillis.
For US buyers, the reported scope offers a measure of reassurance: the tampering is tied to a specific reseller rather than to Ledger's direct sales channel. Even so, the incident highlights the risk that comes with buying hardware wallets through third parties, since a compromised device can leak secrets before a user ever funds it. Ledger has published guidance on how to determine whether a wallet has been tampered with.
Ledger has not stated how many devices are involved or how long the tampering went undetected. The $86 million figure comes from reports on the thefts rather than from the company, and no suspect has been identified publicly. The investigation into CryptoBillis and the implanted devices remains ongoing.
More technology news from TechManNews.
