Ledger's Authorized Reseller Sold an Implanted Wallet

Ledger linked theft exceeding $86 million across hundreds of wallets to devices sold by authorized reseller CryptoBilis, and confirmed an unauthorized implant in one affected device. Block’s Bitkey, meanwhile, opened hardware-wallet preorders in more than 95 countries. CryptoBilis had permission to sell Ledger wallets; no one had authorized the implant.

A hardware wallet keeps private keys away from an online exchange or computer. Buyers also rely on the manufacturer, seller, package, firmware, phone app, transfer route, recovery process, and support response. A secure signing device cannot compensate for an untrustworthy path into or out of it.

The USB vault grew into a consumer service

Bloomberg’s January 2018 coverage put Ledger’s sales at one million USB-dongle wallets. The product answered a clear question: where should someone keep private keys if they did not want an exchange to hold them? A dedicated offline signer offered a different answer from leaving those keys on a connected computer. Buyers still had to obtain the device, set it up, move assets into it, and retain access afterward, but the distinctive feature was the vault.

That same year, Blockchain partnered with Ledger on a wallet designed to enable trades through Blockchain’s brokerage. The pairing showed an early limit of the standalone-vault model: people wanted to use assets as well as isolate them. Each connection that made custody more useful also introduced another interface where the buyer had to recognize the correct product and the correct instruction.

Block took that interface problem further. After a June 2023 beta, it opened Bitkey preorders in more than 95 countries; its planned US price was $150. When Bitkey began shipping in March 2024, Block offered a hardware device together with a mobile app, recovery tools, and Cash App and Coinbase integrations. The app and integrations reduced the distance between acquiring bitcoin and holding it oneself. The recovery tools addressed the other side of custody: a key that nobody else can reach is of little use if its owner cannot get back in.

Block’s launch record establishes the bundle and its broad availability. It does not establish how Block manufactured, shipped, authenticated, or checked each device for tampering. More countries on a preorder page measure reach, not supply-chain assurance. The distinction matters because a buyer encounters the seller and setup instructions before encountering any cryptographic guarantee.

An authorized seller can deliver an unverified device

Ledger told The Verge that theft exceeding $86 million from hundreds of wallets involved devices sold by CryptoBilis, and confirmed an unauthorized hardware implant in an affected device. Reporting identified CryptoBilis as a Malaysia-based authorized Ledger reseller. Authorization answered a commercial question—whether the seller belonged in Ledger’s channel. It did not prove that the device reaching a particular customer retained its intended physical state.

Ledger characterized the volume of affected devices as limited while its investigation continued. Ledger has not specified the precise scope or mechanism across every affected wallet in the cited coverage, and the CryptoBilis case supplies no incident-rate baseline for authorized resellers. There is no comparative channel-volume evidence here showing that reseller implants are becoming more frequent than firmware failures or fraudulent apps. The narrower finding is enough: an authorized purchase path and a confirmed implant coexisted.

Physical protection and physical evidence are separate design jobs. A wallet maker can try to resist tampering; it can also design ways for a buyer or investigator to detect that tampering occurred. Ross Anderson’s Security Engineering distinguishes tamper-resistant protection from tamper-evident design. For a consumer holding a sealed box, that difference is practical rather than semantic: neither the seller’s status nor an intact-looking package independently verifies the electronics inside.

Firmware and phone apps keep the attack surface open after delivery

The reseller case does not make distribution the only dangerous stage. In July 2026, Coldcard shipped a faulty firmware build; CoinDesk reported that more than 1,000 bitcoin, worth about $70 million, was drained from 1,196 wallets in a 41-minute window. A buyer could acquire an uncompromised device and still face risk when the vendor’s software changed. The device’s enclosure remained where it was; the instructions it ran did not.

Companion software creates another route to the same assets. A malicious Ledger Live clone on Apple’s App Store reportedly drained more than $9.5 million from over 50 victims. Earlier, a Trezor user reported losing roughly $600,000 after downloading a fake wallet app from the App Store despite its near-five-star rating. Apple’s approval and the app’s rating were cues a buyer could readily see. Neither established that the software spoke for the wallet maker.

Apple’s store rules also sit within a broader contest over who controls mobile-app distribution. Control over a storefront can determine which apps reach users; it does not, by itself, authenticate every instruction an app gives them. For a wallet owner, the consequential question arrives at setup or recovery, when a convincing screen may ask for information or an action that transfers control.

Apple has described a different kind of trust chain for its Reference Image camera architecture, beginning during manufacturing. A camera feature is not a hardware-wallet security design, and that account proves nothing about any wallet’s controls. It does clarify the engineering distinction: provenance has to persist through the device’s lifecycle rather than appear as a claim at the point of sale.

Recovery protects owners from a failure that isolation creates

Bitkey included recovery tools because custody has two failure cases: someone else gets access, or the owner loses it. In 2022, hacker Joe Grand used fault injection to recover more than $2 million in cryptocurrency from a Trezor One whose owners had forgotten the PIN. The successful recovery did not show that every Trezor could be opened remotely. It did show why an owner locked out of a well-protected wallet might seek a device-level workaround.

Consumer wallet makers must therefore decide which recovery steps a legitimate owner can complete, what evidence those steps require, and how the product distinguishes them from attacker-controlled prompts. A process made so difficult that owners cannot use it can drive them toward informal help and convincing imitations. A process made too permissive can give an attacker the route it gives the owner. Anderson’s security-engineering account treats difficult-to-use mechanisms as vulnerabilities because people must operate them under real conditions, not under a designer’s ideal ones.

Block’s documented recovery tooling makes this a product question for Bitkey, but the available coverage does not describe enough of its recovery controls to judge how it resolves the trade-off. Cash App and Coinbase integrations make transfers easier to reach; they do not answer what a customer should trust when a device is lost, an app looks unfamiliar, or a support message gives conflicting directions.

The vendor must carry verification beyond the checkout

A custody vendor can make each handoff inspectable: identify its approved purchase routes, provide a way to check device and firmware state at activation, keep recovery instructions distinguishable from an unsolicited message, and take responsibility for post-sale incident response. Those are requirements for an auditable journey, not claims that any named wallet has implemented them. They also move work from the buyer back to the company that designed the system and chose its channels.

Ledger’s response shows how far an incident can travel beyond the affected devices. The company paused some hardware sales amid tampering concerns and unveiled Atom, an $899 Android-based companion device planned for summer 2027. Ledger announced Atom alongside the sales pause without identifying it in the cited coverage as a remedy for the implant. The sales pause, however, made device integrity a question of what Ledger could offer for purchase, not merely what its support team could investigate afterward.

The receipt in the CryptoBilis case named an authorized reseller. The implant was inside the wallet.