Ledger stated that unauthorized hardware implants were found at a dealer

Ledger confirmed that unauthorized hardware implants were found in equipment purchased from Southeast Asian dealers. In the ongoing investigation into the financial damage incident,

Hardware wallet company Ledger has confirmed that unauthorized hardware implants were found in at least one damaged equipment purchased through a Southeast Asian dealer. As the company continues to investigate reports of user financial losses, its official X account released an update saying it is reaching out to affected customers and assessing the scope of the incident. At the same time, Ledger urges users who purchase equipment from this designated dealer to take immediate precautions.

At the same time, CryptoBilis, the dealer involved, said it will suspend sales of all Ledger hardware wallet inventory until the investigation is completed and Ledger determines the next steps. Here are the key points of this incident:

• Ledger stated that based on its investigation, one of the affected devices contained unauthorized hardware implants.
• Ledger is contacting users and continuing its investigation; the number of affected customers or the total amount of losses has not been disclosed.
• CryptoBilis has stopped selling Ledger equipment pending the results of the review and Ledger is coordinating follow-up actions with the dealer.
• Ledger recommends not initiating the new equipment setup process from this dealer; if it is already setup, transfer funds to a new Ledger equipment generated using the new mnemonic.

Ledger confirms unauthorized hardware is present in affected devices

On Sunday, Ledger posted on its X account in response to reports related to equipment purchased from Southeast Asian distributor CryptoBilis. Ledger's statement suggests that the incident involved substantial damage at the hardware level-that is, the discovery of unauthorized implants on one of the reported devices-rather than claims of broader penetration of Ledger's internal infrastructure.

Ledger also said it is continuing to reach out to users as part of its ongoing investigation. Independent investigator Specter estimates that the total financial losses involving Bitcoin, Ethereum and Tron could exceed $86 million. Although Ledger has not yet verified how close these estimates are to the final figures, the company emphasizes it is still under active review.

What should users take if purchasing equipment from this dealer

Ledger's guidance focuses on preventing further exposure and reducing the risk of damaged equipment being used to move or authorize funds.

Ledger recommends not starting the setup process for users who have purchased Ledger equipment from this dealer but have not yet completed setup. The reason is straightforward: If the hardware has been tampered with, running the initialization step may expose the wallet's security assumptions to risk.

For users who have already set up their devices, Ledger recommends transferring assets to a new Ledger signing device created using new mnemonic words. This effectively cuts off any potential connection between the compromised hardware and the user's subsequent security posture.

Dealers suspend sales, Ledger coordinates next steps

CryptoBilis, the dealer at the core of the investigation, confirmed in Ledger's update that it had stopped selling all Ledger hardware wallet inventory until the investigation was completed. Ledger said it is actively communicating with CryptoBilis to determine next steps, which suggests remedial measures may involve operational controls and further verification of affected supply batches.

Earlier reports pointed out that CryptoBilis is listed as an authorized Ledger dealer in Indonesia, Malaysia and the Philippines. While this background helps understand how customers purchase equipment through legal channels, Ledger's latest update defines the problem as limited to that single dealer and its market.

Ledger denies that its systems were compromised.

Ledger stated that the incident appeared to be limited to dealer relationships and did not reflect a breach of Ledger's broader security environment. In a statement to media, Ledger said: "Ledger's infrastructure, systems and services have not been compromised," adding that its investigation is still ongoing.

This distinction is important for users trying to assess risk. If Ledger's systems and services are not compromised, the main threat model will shift to supply-chain tampering and device-level sabotage-meaning that customers who obtain equipment through specific channels may face a different risk profile than customers who purchase elsewhere.

Ledger also said it had not yet confirmed how many customers might have been affected or the value of the losses described in the report. During this period, the company invited people who provided information relevant to the investigation to contact its vulnerability bounty program (bounty@ledger.fr).

The future of the survey

As Ledger continues its survey, wallet owners 'biggest concerns remain unanswered: how many devices are involved, which specific batches and timelines are affected, and what verification steps users can rely on before resuming normal use. Before Ledger provides more details, customers should follow the company's set-up and funds migration guidance for any equipment purchased from the Tagged Dealer channel.