Ledger has suspended sales through reseller CryptoBillis after reports that roughly $86 million in cryptocurrency was stolen from user wallets, according to CoinDesk. The France-based hardware wallet maker asked the reseller to pause all sales while it investigates suspected tampering with its devices.

The company confirmed its action in a public post on X. "We have asked CryptoBillis to pause all sales of Ledger wallets while we investigate," Ledger Support wrote on the platform.

What does the suspected tampering involve?

Photos and videos posted on X and Threads appear to show a small circuit board sandwiched underneath the wallet's screen. The images were shared publicly, including by users who reported losses, and they now anchor the investigation into how the devices were altered before they reached customers.

The implant allegedly intercepts anything displayed on the screen. That includes the seed passphrase shown during initial setup — the recovery phrase that grants full control over a wallet's funds. According to the reports, the board then exfiltrates that information using an embedded SIM card. The attacker receives the seed phrase remotely and can drain the wallet at will. The hardware is small enough to sit under the display without obvious signs of modification.

How did the supply chain fail?

The suspected point of compromise is the reseller channel, not Ledger's own production. CryptoBillis sold the wallets to end users. This distinction matters for the commercial picture: it suggests devices were altered after manufacture, during distribution, rather than compromised on the assembly line.

Hardware wallets such as Ledger's are built on the premise that keys never leave the device in plaintext. A physical implant that reads the screen inverts that trust model at the point of sale. The customer verifies transactions on a display that has been turned into a listening device.

Ledger has not said how many devices may be affected. It has also not stated how long CryptoBillis had been selling the modified units, or whether it has identified the source of the implant hardware.

What should Ledger owners do now?

For users who bought a device from CryptoBillis or any third-party reseller, the reported mechanism points to one check: inspect for hardware that does not belong. The published images show a visible board under the screen. Users who generated a seed phrase on a suspect device should treat that phrase as compromised.

The reports follow a pattern seen in earlier crypto theft cases, where intercepting a seed phrase at setup defeats the security model entirely. An embedded SIM card, as described in the reports, removes the need for the attacker to be physically near the victim. The theft appears to have unfolded over time, with funds siphoned from drained accounts once attackers held the recovery phrase.

What happens next?

Ledger says its investigation is ongoing. The pause on CryptoBillis sales remains in force until it concludes. The $86 million figure, first reported by CoinDesk, makes this one of the largest suspected hardware-wallet compromises on record. The outcome will likely shape how Ledger and its competitors police the reseller channel, since the tampering, if confirmed, happened between the factory and the buyer rather than inside the product itself.