Ledger Reports Counterfeit Hardware in CryptoBilis Device
Ledger says a device sold through CryptoBilis contained an unauthorized hardware implant. The case points to risks in the distribution chain, not in Ledger’s internal systems.
Key Takeaways
- Ledger says an unauthorized hardware implant was found in at least one device sold through CryptoBilis.
- The company says its internal security infrastructure, systems, and services were not affected.
- On-chain researchers estimate the damage across more than 300 wallets on multiple blockchains at between $86 million and $93 million.
Ledger says an unauthorized hardware implant was found in at least one device sold through CryptoBilis. The crypto company stressed that there is no indication its own internal security infrastructure, systems, or services were affected. According to on-chain researchers, the damage across more than 300 wallets on multiple blockchains could be between $86 million (€76.7 million) and $93 million (€83 million).
Investigation and Warning
Ledger says it is working with the relevant authorities. The company also repeated its advice to customers who bought a device through CryptoBilis: do not initialize unused devices, and move an already set up device to a new seed on a Ledger device. Users are asked to contact official Ledger Support and file a report with local police.
The company also warned about fake influencers and scammers trying to take advantage of incidents like this. Ledger says it will never call, reach out via DM, or ask for a 24-word recovery phrase.
What Went Wrong
Ledger says the physical tampering appears to be limited to the batch distributed through CryptoBilis. The company has again reminded distributors of the importance of buying products only through authorized channels and not putting returned products back into inventory.
The case fits into a broader wave of problems around hardware wallets. In 2026, several providers, including Coldcard, Trezor, Tangem, BitBox, SafePal, and Ledger, reported security issues. The Ledger case shows that the risks are not only in software, but also in the distribution chain itself.
Why This Matters for Users
For European crypto users, this matters because hardware wallets are often seen as the last line of defense for self-custody. If a device is altered before delivery, the risk shifts from the chain to the route it takes to get there. That makes checking the source, packaging, and distribution more important for many users than just choosing the brand.
The case also follows earlier incidents in the industry. In July 2026, a bug in Coldcard's seed-generation firmware reportedly led on-chain researchers to a loss of more than $115 million (€103 million) in Bitcoin. Recent reports about a hidden chip in a sealed Ledger wallet also show how vulnerable hardware wallets are to tampering before use. That underscores that both firmware and physical delivery can be weak points.
