Ledger wallet tampering is under investigation after a cryptocurrency theft linked to hardware wallets sold by CryptoBilis, a reseller in Southeast Asia. Ledger says it found an unapproved chip in at least one device.
Bitquery estimates that about $102 million in assets left 324 wallets across six networks. The firm updated its on-chain estimate on October 13. Ledger has not confirmed a final loss total. Investigators are still assessing the case, so the estimated losses and number of affected devices could change.
What the Ledger Wallet Tampering Investigation Has Confirmed
Ledger said a customer’s device held an unapproved hardware implant. CoinDesk reported that the implant could capture the 24-word recovery phrase shown during setup and send it through a mobile connection. That phrase is the key to a wallet. A thief who gets it may open the wallet on another device and move the funds.
In the Ledger wallet tampering case, Ledger says CryptoBilis sold the affected devices. Ledger asked the reseller to pause sales while investigators check them. The confirmed implant in one device does not prove it compromised every stolen wallet in the same way. Investigators have not yet established how many devices the implant reached.
How the $102 Million Estimate Was Made
Bitquery links about $102 million in stolen assets to 324 wallets on TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. The Ledger wallet tampering estimate grew as the team found more wallets and transfers. Chain records can show funds leaving an address. They cannot name every victim or prove how attackers obtained each phrase.
Tether froze about $10 million in USDT tied to the case, Bitquery said. That does not mean investigators have recovered the remaining funds. The estimate may change if researchers identify more wallets or revise earlier links.
Steps for People at Risk
In the Ledger wallet tampering case, Ledger told customers who bought through CryptoBilis not to set up an unused device. Anyone who used a potentially affected device should check the risk. If someone may have obtained your recovery phrase, move funds to a trusted device with a new phrase. Follow the maker’s verified guide. Never type a recovery phrase into a website or share it with support staff.
People who lost funds should watch for recovery scams. No one can promise to undo a chain transfer with only a wallet address or transaction hash. A new account password will not protect funds if someone has obtained the recovery phrase.
What Remains Unknown in the Ledger Wallet Tampering Case
Investigators still need to establish how the chip entered the devices and how many units it reached. They also need to determine whether it explains every reported loss. The Ledger wallet tampering case points to a serious supply-chain risk. But the $102 million figure is a third-party estimate, not a final total that Ledger has confirmed. Readers should keep that difference in mind.
For more context, read our report on Ben Zhou’s support for ZachXBT’s Lazarus investigation.
Sources: CoinDesk, October 13; Bitquery investigation, updated October 13; Ledger reseller directory; BleepingComputer, October 12.
