Web3 Is Going Just Great, a site that catalogs crypto-related hacks, scams and exploits, reported on October 12 that tampered Ledger hardware wallets led to at least $86 million in losses. The devices were reportedly resold by a party identified as CryptoBilis.
Hardware wallets like those made by Ledger are designed to store private keys offline, away from internet-connected devices. That isolation is meant to protect users from remote hacking attempts that target software wallets and exchange accounts. The model relies on one key assumption: the device itself must arrive in the hands of the user unaltered.
Tampering schemes undermine that assumption by targeting the supply chain before a wallet ever reaches its intended owner. If a device is modified before sale, whether through altered firmware, a pre-generated seed phrase, or other hidden manipulation, an attacker can potentially gain access to funds once the victim loads them onto the wallet. This type of attack does not require breaching Ledger's own systems or software, since the compromise happens at the reseller or distribution stage instead.
The report names CryptoBilis as the reseller connected to the tampered devices. No additional details about the scale of distribution, the number of affected users, or the specific method of tampering were included in the reporting reviewed for this article. The $86 million figure represents the total losses identified by Web3 Is Going Just Great as of its publication.
Ledger has faced scrutiny in the past over third-party resale risks, since counterfeit or modified devices sold outside official channels have periodically surfaced in the broader hardware wallet market. Security researchers and the company itself have long advised buyers to purchase directly from Ledger or its verified retail partners, rather than secondary marketplaces, to reduce exposure to this category of risk.
It remains unclear from current reporting whether Ledger has issued a direct response to the CryptoBilis-linked losses or whether law enforcement agencies have become involved. The incident has not yet been independently detailed by other outlets covering crypto security, and readers should treat the $86 million figure as the reported total from a single tracking source pending further confirmation.
Market Impact
Hardware wallets are widely marketed as the most secure option for long-term crypto storage, particularly for holders who want to avoid exchange custody risk. A confirmed case of large-scale losses tied to tampered devices could unsettle that perception, especially among retail investors who rely on third-party or secondary market sellers to cut costs.
If the losses are verified and traced definitively to supply chain tampering, it may prompt renewed calls for stricter verification standards among hardware wallet manufacturers and resellers. It could also push more buyers toward purchasing directly from official channels, even at a higher price, to avoid exposure to modified devices.
The reported $86 million in losses underscores a persistent weak point in self-custody security: the supply chain between manufacturer and user. Further detail from Ledger, law enforcement, or additional reporting will be needed to confirm the scope and mechanics of the alleged tampering scheme.
Frequently Asked Questions
What is CryptoBilis?
CryptoBilis is identified in the report as a reseller of hardware wallets connected to the tampering scheme. No further details about the entity were provided in available reporting.
How could a hardware wallet be tampered with before sale?
Attackers can modify firmware, pre-generate a seed phrase, or otherwise alter a device before it reaches a buyer, allowing them to access funds once the wallet is activated and funded.
Has Ledger responded to these claims?
Available reporting does not indicate whether Ledger has issued a public statement addressing the tampered devices or the losses attributed to CryptoBilis.
How can buyers protect themselves from tampered hardware wallets?
Security experts generally recommend purchasing hardware wallets only from the manufacturer directly or from officially verified retail partners, avoiding secondary or unofficial marketplaces.