An unauthorized hardware implant found in some Ledger crypto wallets appears to be the source of an $86 million supply chain theft, according to investigators. The discovery follows mounting reports from users who said funds were drained from their accounts after purchasing wallets through the reseller CryptoBillis. Ledger announced it is halting all sales of the affected devices while the company conducts a forensic review. The company confirmed that one impacted device contained a circuit board placed beneath the screen without authorization.

The implant, visible in photos shared on social platforms, reportedly intercepts data displayed on the wallet’s screen, including the seed phrase entered during setup. Using an embedded SIM module, the device allegedly transmits captured information back to an external actor. Security researchers tracking the incident say the stolen funds originated from hundreds of wallets, primarily among users in Southeast Asia.

Ledger stated its core manufacturing systems remain intact and that wallets sold directly through official channels were not compromised. The breach appears confined to devices distributed via CryptoBillis, a third-party vendor now under scrutiny. The company has released technical guidance to help users identify signs of tampering, such as irregular packaging or unexpected weight.

This incident underscores growing risks in the cryptocurrency hardware market, where supply chain vulnerabilities can enable large-scale theft even without direct breaches of corporate infrastructure. Authorities and cybersecurity teams are collaborating on further analysis. No arrests or formal attributions have been made public to date.