Ledger has issued an urgent warning to customers who purchased hardware wallets from the Southeast Asian reseller CryptoBilis within the last 90 days. The company advises users to immediately stop using these devices, as investigations revealed that compromised units were used to drain assets from hundreds of wallets.
On-chain analysis estimates total losses between $86 million and $93 million. The affected wallets operated across multiple networks, including Bitcoin, Ethereum, and TRON. Ledger confirmed that every verified case of asset theft was linked to devices sold through the CryptoBilis distribution channel.
Technical analysis identified an unauthorized LTE-enabled microcontroller with eSIM functionality inside the tampered devices. This implant allowed attackers to capture recovery phrases during the initial setup process without affecting the device's secure element. Ledger stated that its direct sales channels remain unaffected.
Following the discovery, Ledger ordered CryptoBilis to halt all sales and shipments on October 9, 2026. The reseller, which operates in Indonesia, Malaysia, and the Philippines, has suspended operations. Ledger is currently reviewing its reseller protocols and collaborating with authorities and the security group SEAL 911.
