Ledger Reveals Major Hardware Wallet Breach Linked to CryptoBilis

Breach Details

The breach was discovered by Ledger, which confirmed that at least one of its devices sold by CryptoBilis contained an unauthorized hardware implant. This implant allowed attackers to access users' recovery phrases, putting the funds at risk.

Affected Devices and Wallets

The affected devices were purchased from CryptoBilis within the last three months. Estimates put the damage at between $72 million and $93.2 million, drained from 311 to 315 wallets across multiple blockchains.

Losses and Distribution

Most of the losses landed in one place. Roughly $70 million of the stolen funds were in USDT on the Tron blockchain. The rest was spread across other blockchains, including Bitcoin, Ethereum, BNB Chain, Polygon, and Solana.

Response and Recommendations

Ledger stressed that its own systems and direct sales channels were not affected. The company also used the moment to remind resellers that returned products should never be restocked.

Industry Implications

For anyone holding a device bought through a reseller, the practical takeaway is to verify where it came from. Buyers of CryptoBilis units in particular should follow Ledger's instructions and treat existing seed phrases as exposed.

Investigation and Recovery

The CryptoBilis case turns the theoretical risk of supply chain breaches into a confirmed one. The outcome of the investigation, any clarification on the possible ownership change, and whether the confirmed wallet count or loss estimates move further will shape how much victims ultimately recover.