Ledger says unauthorized implant found in at least one device sold by CryptoBilis

In practice, however, physical storage has not been immune to vulnerabilities.

In July 2026, a flaw in Coldcard’s seed-generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to data from on-chain researchers.

In this current exploit, Ledger maintains that the physical tampering is strictly isolated to the batch distributed by CryptoBilis and it is taking necessary steps to avoid such risks.

“Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes,” Ledger said in its Oct. 11 post.

It added that it is reviewing authorized reseller controls, advancing hardware protections, and calling for broader industry improvements in chain-of-custody practices.

Still, speculation regarding how the supply chain was breached continues to circulate.

In a post on X, Binance co-founder Changpeng Zhao (CZ) alleged that the attackers “apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut.”

These claims have not been independently verified. CryptoBilis did not immediately respond to requests for comment regarding the incident or Zhao's specific allegations.