Ledger confirms unauthorized hardware implant in at least one user device

The confirmation of a physical implant shifts the threat model from software exploits to supply-chain tampering, which no amount of firmware hygiene fully addresses. The exposure sits with buyers routed through third-party resellers rather than Ledger's own channels, and CryptoBilis halting hardware wallet sales signals the distributor is now part of the investigation's scope. Whether the tampering is isolated to a single device or reflects a broader reseller-path problem is the open question, and it is the reseller layer — not the wallet maker's internal systems — that warrants watching.