Image credit: Shutterstock
- Concerns over tampered Ledger hardware wallets reached Europe after a user reported an unauthorized implant in a device bought from a European reseller.
- Ledger confirmed an unauthorized hardware implant in at least one device tied to an investigation involving Southeast Asian reseller CryptoBilis.
- On-chain investigator estimates of suspected losses from the wallet tampering have risen above $86 million across multiple networks.
Concerns over tampered Ledger hardware wallets have reached Europe after a user reported finding an apparent unauthorized implant inside a device bought from a European reseller. Ledger has separately confirmed an implant in at least one device tied to an investigation involving Southeast Asian reseller CryptoBilis, while on-chain estimates of suspected losses have risen above $86 million.
The European device has not been linked to any reported theft, and Ledger has not publicly confirmed that case. The company says it does not indicate that its own security infrastructure, systems, or services were compromised.
European Device Raises Wider Supply-Chain Concerns
Crypto user Johannes said the device had been bought from a European reseller several weeks earlier and shared images showing wiring not normally present in genuine Ledger hardware. Former Mt. Gox CEO Mark Karpelès, who has been examining suspected tampered devices, said the European device appeared to contain what he considered an earlier version of the implant seen in other suspected cases.
No funds had been stolen from the European wallet when the device was disclosed. Ledger’s earlier confirmed case involved a customer connected to CryptoBilis, which sells hardware wallets in Indonesia, Malaysia, and the Philippines.
Ledger Confirms Implant in One Affected Device
Ledger said one device examined during its investigation contained an unauthorized hardware implant. CryptoBilis subsequently halted hardware-wallet sales while the investigation continues.
“Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.”
Ledger advised people who bought from CryptoBilis during the previous 90 days not to initialize unused devices. Those who already set them up were told to consider moving assets to a new signer using a newly generated recovery phrase.
Loss Estimates Continue to Rise
Early on-chain estimates placed suspected losses above $72 million, later rising past $86 million across Bitcoin, Ethereum and Tron. Those figures were investigator estimates rather than totals confirmed by Ledger.
Bitquery later identified about $93.2 million in transfers associated with 315 wallets under investigation across six networks, without establishing that every transfer resulted from the same tampering method.
The firm said $10 million in USDT had been frozen by Tether, while much of the remaining crypto continued moving through wallets, swaps, and privacy tools.
Investigation Has Not Established the Full Scope
The confirmed implant strengthens evidence of physical tampering in at least one affected device, but investigators have not established that every reported loss came from the same method. The European report also remains separate from Ledger’s confirmed CryptoBilis case.
The available evidence is consistent with a potential distribution-chain tampering problem, while Ledger says it has found no indication of a breach of its core systems. Its geographic reach, number of affected customers and final loss total remain unresolved.
