Ledger has warned customers about physically modified hardware wallets linked to reseller CryptoBilis, in a case investigators say may be tied to reported crypto losses of roughly $90 million or more. The company said the issue did not stem from a compromise of Ledger’s own systems, but from interference with devices before users set them up.

The reported attack focuses on the supply chain rather than online phishing or malware. According to reports cited in the source material, altered devices may have included implants capable of capturing a user’s recovery phrase during initialization and sending that information to attackers.

A supply-chain attack on hardware wallets

The case has drawn attention because it targets one of the main assumptions behind hardware wallet security: that strong cryptography and isolated key storage are enough if the device arrives intact. In this instance, the danger appears to come from physical tampering before the owner even switches the wallet on.

If an attacker can obtain a recovery phrase during setup, the protection offered by the device can be undermined. Anyone with that phrase may be able to recreate the wallet elsewhere, potentially gaining access without needing the original hardware in hand.

What Ledger says happened

Ledger said confirmed cases involved wallets sold through CryptoBilis, a reseller listed in parts of Southeast Asia. As the investigation continued, Ledger said it asked the reseller to halt sales and shipments tied to the issue.

The company also stressed that its own systems were not compromised. That distinction matters because the reported problem was described as physical modification of devices rather than a breach of Ledger infrastructure or a standard software-based attack.

Guidance for affected customers

Ledger advised customers who received potentially affected devices not to initialize them. For wallets already in use, the company said funds should be moved to wallets protected by newly generated recovery phrases created on trusted equipment.

The warning reflects the core risk in the case: once a recovery phrase has been exposed during setup, the wallet may no longer be secure even if the device appears to function normally afterward.

Unclear scope and broader implications

The estimated losses connected to the case remain just that—an estimate. Investigators have linked roughly $90 million or more in reported crypto losses to the incident, but a full public accounting of the number of affected units has not been established.

The reports also raise a broader concern for hardware wallet buyers. A device passing ordinary software or chip authenticity checks should not automatically be taken as proof that no unauthorized physical component has been added elsewhere. The episode highlights how provenance, reseller controls, and physical integrity checks can matter alongside firmware verification and backup practices.

What is confirmed next

For now, the confirmed next step is the continuing investigation into devices sold through the CryptoBilis channel. Ledger has already requested a halt to sales and shipments while that process unfolds.

Until more is publicly established about the number of altered units and the final loss total, the case stands as a reminder that hardware wallet risk can extend beyond software and into the distribution chain itself.

Source: bitcoinist.com