Ledger has paused sales through reseller CryptoBilis after reports of stolen funds from buyers in Southeast Asia. The company later said one impacted device contained an unauthorized hardware implant.

What happened

Ledger said on 10 October that it was investigating loss-of-funds reports tied to CryptoBilis purchases. Blockchain investigator Specter put the reported losses above $86 million. That figure is an investigator estimate, not a Ledger-confirmed total.

Ledger then confirmed an unauthorized hardware implant in one user's device and said it is contacting affected buyers. On 11 October it said a limited number of devices are involved, and that every confirmed case was sold through CryptoBilis. CryptoBilis has stopped selling hardware-wallet stock until the probe ends.

Who is affected

The confirmed cases are devices sold by CryptoBilis, not the general Ledger channel. Anyone who bought a hardware wallet from an unauthorized reseller in the last 90 days should treat the device as suspect until it is checked.

• Do not start setup on an unused device bought from this reseller in the last 90 days.
• A recovery phrase that arrived pre-printed, or that anyone else has seen, means the wallet is unsafe.
• Offers to "recover" lost funds are a common follow-on scam. Ledger and CryptoBilis will not ask for the phrase or PIN.

What to do now

If you already set up a CryptoBilis-sold Ledger, move assets to a new signer with a new seed generated on that device, and never type the old phrase into a website or chat.

Buy hardware wallets only from authorized channels. Resellers should not restock returned units. For an MSP, this is a supply-chain check: staff or clients who bought "discount" signing devices outside official distributors need a fresh seed, not a firmware pep talk.

Source: The Hacker News, 12 October 2026. Ledger Finds Unauthorized Hardware Implant in CryptoBilis-Sold Wallet Amid Fund Theft Reports.

Also on the blog

• CVE-2026-102255: SonicWall SMA1000 CVSS 10.0 SSRF under attack
• CVE-2026-97229: GitLab CI/CD regex compiler CVSS 10.0 RCE
• Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
• Bricksforge CVE-2026-85097 CVSS 10 WordPress RCE Exploited

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.