- Ledger says a device belonging to a user who lost funds had been physically altered, with an implant added to the hardware.
- The reseller at the centre of it, CryptoBilis, has now stopped selling all hardware wallet stock rather than only Ledger units, according to Ledger.
- Neither company has said how many devices passed through the same seller, which is the number that decides how big this is.
The advice to buy a hardware wallet usually comes with a second half that gets repeated far less often: buy it from the people who made it. A device that has been through somebody else’s hands can be changed before it reaches you, and Ledger’s account of this case is that one was.
Every security promise made for a hardware wallet rests on the device in your hand being the one the factory built. If it isn’t, keeping your key away from the internet protects nothing, because the problem arrived inside the box. Where you buy the thing matters as much as which one you buy.
This follows an earlier report of buyers losing funds after purchasing through the same reseller, which at that point had led to a pause on sales of Ledger devices only. The pause now covers the reseller’s entire hardware wallet inventory, whatever the brand.
One thing to be straight about: we have not seen a statement published by either company. The account of the implant comes from Ledger, reported by The Defiant, and we found no primary document or independent technical write-up behind it. That is a company’s own explanation of an incident it is investigating, not a verified finding.
What an implant actually is
Your crypto doesn’t live in the wallet. It lives on the , and what you own is a , a very long secret number that proves the coins are yours and lets you move them. A hardware wallet is a small device that holds that key and is built so the key never touches an internet-connected computer.
That design defends against software. Malware on your laptop can’t reach a secret that never leaves the device.
A supply-chain implant goes around the whole argument by attacking the object itself. Someone opens the device before it reaches the buyer and adds or replaces components, so the hardware you set up is not the hardware the manufacturer shipped. The modification can sit there doing nothing visible while the owner follows every instruction correctly. Ledger has not described what this particular implant did, and until somebody publishes a teardown, nobody outside the investigation can say.
Not the same failure as Coldcard
It’s worth separating this from the other hardware wallet story of recent weeks. In the Coldcard case, the problem was inside the product: some devices generated keys that weren’t random enough, which meant they could be worked out. Those devices came straight from the maker and were faulty as designed.
Here, on the evidence available, the cryptography isn’t the thing in question. The distribution is. A sealed, genuine Ledger bought from Ledger is not implicated by anything reported so far. One is a manufacturing flaw, the other a question about who handled the box between the factory and the buyer, and the fixes for them look nothing alike.
Which is also why the useful number here is a count of units rather than a list of model names.
What a UK buyer can reasonably check
Buy direct from the manufacturer’s own shop or an authorised seller listed on the manufacturer’s site. Marketplace listings, third-party sellers and second-hand devices all introduce a gap that nobody can audit afterwards.
Tamper-evident packaging helps a little, though seals can be reproduced, so treat it as one signal rather than proof. Ledger Live and the equivalent apps from other makers run a genuineness check against the device on setup, which is worth doing even if everything looks right.
The clearest red flag costs nothing to spot. A new device should ask you to create a yourself, on the device. If one arrives already set up, or with a card of words printed or written in the box, the correct response is to put no money on it at all and contact the manufacturer. We go through the rest of this in our guide to self-custody, and the trade-offs between the two main brands in our Trezor vs Ledger comparison.
What to watch
How many devices went through this reseller, and over what period. Ledger has widened the sales pause but has published nothing that would let a buyer work out whether their own purchase falls inside the affected window. Until that exists, people who bought from the same place are being asked to wait without being given anything to act on, and that is squarely within Ledger’s power to fix.
Beyond that, whether an independent analysis of a modified unit appears. A teardown from someone with no stake in the outcome would turn a company’s explanation into an established fact, and would also show whether other brands sold by the same seller need checking.