Hidden implants in reseller wallets drain cryptocurrency funds
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Tuesday, October 13th, 2026.
Cryptocurrency was stolen from customers who received tampered Ledger hardware wallets through Southeast Asian reseller CryptoBilis. Ledger confirmed that at least one affected device contained an unauthorized hardware implant, although the exact point of tampering remains unknown. Researchers said the concealed hardware could capture screen output and button presses, then transmit recovery information over a mobile connection. Ledger described the confirmed volume as limited.
Every confirmed report identified by the company involved devices sold through CryptoBilis. One important complication is that Ledger’s authenticity check may still pass when the original security chip remains intact. Software verification therefore can’t rule out extra hardware hidden inside a device. Leaders should make sure supply-chain assurance covers reseller custody, product returns and physical modification. Defenders and customers should avoid initializing unopened devices from the reseller. Wallets that have already been configured should be replaced with a new device and seed.
Trusted hardware is only as trustworthy as its delivery path. Stop using affected reseller devices and move assets to a newly sourced wallet initialized with a completely new recovery seed.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
