Ledger warns CryptoBilis customers after tampered wallets linked to $86M-$93M losses
Ledger warned customers who bought hardware wallets from reseller CryptoBilis to stop using them after tampered devices were tied to losses estimated at $86 million to $93 million across hundreds of wallets. At least one affected device contained an unauthorized LTE-enabled microcontroller with eSIM capability that could capture a recovery phrase during setup. Ledger halted CryptoBilis sales and shipments and said its direct sales channels were not affected.
Ledger's warning applies to hardware wallets purchased through CryptoBilis, a reseller active in Indonesia, Malaysia, and the Philippines. The company stopped that reseller's sales and shipments on Oct. 9, 2026, then said the next day that a tampered unit held an unauthorized LTE microcontroller with eSIM support. This component could record a recovery phrase as setup occurred while leaving the secure element untouched.
Verified drain cases were linked to CryptoBilis purchases, and affected wallets covered Bitcoin, Ethereum, and TRON. CryptoBilis has paused sales. Ledger is examining reseller safeguards and anti-tampering practices, says its own sales channels were unaffected, and is cooperating with authorities and SEAL 911. The guidance covers purchases from the prior 90 days.
The warning may affect crypto holders who rely on resellers, especially in Southeast Asia, by eroding trust in third-party hardware distribution. Customers could face financial loss, stress, and time-consuming migration to new devices and phrases. It may also push manufacturers and resellers toward stronger tamper checks and clearer supply-chain transparency. Broader adoption could slow if buyers worry that hardware wallets are only as safe as the route they travel through.