Ledger Found a Hardware Implant in a User’s Wallet

Ledger discovered a hardware implant in a user’s crypto wallet during a theft investigation. The company is asking some owners not to power on their devices and to check where and how they were purchased.

The incident also affected reseller CryptoBilis, which temporarily suspended sales of all hardware wallets. At the same time, researchers warned about fake Ledger websites and apps in Google Search. They steal seed phrases.

What exactly did Ledger find, and who does it affect?

According to support, an unauthorized hardware implant was found in one of the victims’ devices. Ledger says it is working with law enforcement and reseller CryptoBilis, and also thanked the SEAL 911 team for its help. This matters for people who bought hardware wallets through this channel.

The company separately stressed that there are currently no signs of compromise of its systems, infrastructure, or services. In other words, based on the available data, the problem is not a hack of Ledger itself. The issue now is in the supply chain. And that is a different story.

Ledger advises those who bought a device from CryptoBilis but have not yet set it up not to begin activation. And if the wallet has already been initialized, it may be worth moving assets to a new device with a new seed phrase. That is where the risk is highest.

Why did this story go beyond one reseller?

Because this is not just about one device. According to Bitquery, the estimated losses have risen to $93.2 million. It also refers to 315 wallets across 6 networks, including TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon.

There is another warning sign. Bitquery says 25 TRON wallets signed the same approval within 3 seconds. Before the main drain, there were also 2 weeks of test transactions. This looks like a well-prepared scheme rather than a random failure.

The largest share of losses came from TRON and USDT. According to Bitquery’s estimate, Tether froze $10.0 million in USDT across 20 wallets, but another roughly $10.0 million in USDD is harder to block.

Fake Ledger in Google Search: how the trap works

Separately, researcher Cyber Scrilla reported a fake Ledger website and app that appeared among the top Google Search results. He wrote that the pages were created to steal seed phrases. According to him, Google showed more than 1 million visits over 30 days.

This is not a minor issue. Earlier, Zscaler ThreatLabz had already described a campaign against Ledger users through malicious Google ads. The scheme ran through Google Cloud Storage, Vercel, and a fake Google Sites page. Vercel redirects changed every 15-20 minutes.

In simple terms, this is a trust game. A person sees a familiar brand, follows the link, and hands over the secret phrase themselves. After that, the money cannot be recovered with a single click.

Market reaction

The hardware wallet market reacts painfully to such stories even without a direct hack of the company itself. The reason is simple: trust matters more than advertising here. If a user starts doubting the supply chain, they transfer the risk to the entire brand.

This topic is even more sensitive for Ledger because the company itself talks about scale. Its website says it has more than 8 million devices, users in 195 countries, and protection for more than 20% of the world’s digital assets. So even a local incident with a reseller damages the reputation far beyond one market.

• Ledger sees no signs that its systems were hacked.

• CryptoBilis has suspended sales of all hardware wallets.

• Users are advised not to activate new devices from this channel.

• Activated wallets should be checked and, if needed, funds should be moved.

• The seed phrase should never be entered on websites or in search.

Against this backdrop, it is also important to remember older risks. In August, the OneKey Anzen team reported an attack in which the Ethereum app for Ledger version 1.22.1 could have a transaction swapped during signing. This once again shows that the weak point is often not the coin, but the interaction point.

What does this mean for investors?

For crypto holders, the main takeaway is simple: check not only the device itself, but also the path it took to reach you. If you bought a wallet through a reseller, keep the receipt, packaging, and serial data. This may help during an investigation.

The second point concerns the seed phrase. Ledger clearly says it never asks you to share the 24-word recovery phrase. If a website, ad, or chat requests it, stop. That is exactly how phishing traps work.

For Ukrainian users, there is another practical point here. If you keep a significant amount in one wallet, it is better to have a separate new device for cold storage. This is not a trendy tip, but a way to avoid mixing old risk with new assets.

Frequently asked questions

Do I need to urgently turn off all Ledgers?

No, the message is not about all devices, but about a portion of users linked to a specific reseller. Ledger says its own systems were not compromised. But if you bought a wallet from CryptoBilis and have not yet set it up, it is better not to begin activation.

Why can’t the seed phrase be entered into Google or on a website?

The seed phrase gives full access to your funds. If you enter it on a fake page, the money can disappear instantly. That is why Ledger reminds users that the company never asks for the 24-word recovery phrase.

What should I do if the wallet has already been activated?

Ledger advises considering moving assets to a new device with a new seed phrase. This is especially relevant if you bought the device from a seller mentioned in the investigation. The sooner you do it, the lower the chance of running into a hidden problem.

The Ledger story shows a simple thing: in crypto, danger often comes not through the blockchain itself, but through a website, a seller, or a fake page. If you need to quickly sell Bitcoin on Monobank, do it through a verified service and do not rush into suspicious links.

This material is not financial advice. Cryptocurrency trading involves significant risks. Part of this text was prepared with the help of artificial intelligence based on public sources and reviewed by our editorial team.