Ledger, the French maker of the world’s best-known hardware crypto wallets, has confirmed that at least one device linked to a wave of recent fund thefts contained an unauthorized hardware implant. The company says every confirmed case so far involves wallets sold through CryptoBilis, a reseller operating in Southeast Asia, and it is telling those customers to stop using the devices immediately.
On-chain researchers tracking the thefts estimate that between $86 million and $93 million has been drained from more than 300 wallets across Bitcoin, Ethereum, Tron, Solana, BNB Chain, and Polygon. If the numbers hold, this is one of the largest supply-chain attacks in crypto history, and it strikes at the one product category millions of investors adopted after the FTX collapse to keep their money out of reach: self-custody hardware.
What Ledger confirmed and when
The incident surfaced on October 9, 2026, when Ledger said it was investigating reports of missing funds from customers who had bought devices through CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. In a statement on October 10, Ledger Support confirmed that one affected user’s device contained an unauthorized hardware implant, and said it was actively contacting impacted users as part of an ongoing investigation.
An October 11 update added that the volume of affected devices appears limited. Ledger’s wording was careful: to date, all confirmed cases related to the disclosed draining incident involve devices sold through the Southeast Asian reseller CryptoBilis. The company said its internal systems and direct sales channels were not compromised, and there is no indication its own security infrastructure was breached.
CryptoBilis has suspended sales of its entire hardware-wallet inventory until the investigation concludes, and it has promised an update around October 14 to 15.
How the implant reportedly works
Ledger has not published a full technical breakdown, but images and videos circulating on social media show a small circuit board hidden beneath the device’s screen, reportedly designed to intercept whatever is displayed on the screen during setup. That matters because the seed phrase, the set of 24 words that controls every coin in a wallet, is shown on the device screen when a new wallet is created. If an implant can read that screen and transmit the words out, the attacker holds a copy of the keys before the owner ever makes a transaction.
Independent researcher Mark Karpelès said he separately found a hidden chip inside a Bitcoin-compatible Ledger Nano X capable of reading the seed phrase even from unopened factory packaging. Some reports describe an embedded SIM-style module relaying captured data to the attacker. The exact transmission method has not been officially confirmed, but the on-chain behavior points to a single thief holding the stolen keys: Bitquery’s live tracking found that 25 Tron wallets signed the same approval within three seconds, and dozens of wallets handed control to the attacker’s key within minutes, after about two weeks of small test transactions in late September.
Where the money went
Bitquery, which is maintaining a live investigation, counts $93.2 million taken from 315 wallets across six chains. On October 10 the thief ran roughly 1,736 ETH through Tornado Cash and Zcash, and it came out as USDC. Tether has frozen about $10 million in USDT across 20 wallets, and Circle can now freeze roughly 5.35 million USDC tied to the laundered coins. Bitquery estimates that around $81 million could still be found on-chain as of October 11.
That gap between the drained total and the frozen amounts is the sobering part: once seed phrases are in an attacker’s hands and the funds move through mixers, recovery is an exception, not the rule.
Is the scare spreading beyond Southeast Asia?
Ledger maintains that all confirmed cases trace to CryptoBilis. But on October 11, a well-known crypto commentator posted photos of extra wires inside a Ledger device bought from an official European reseller, claiming a spy implant that looked like an earlier version of the one Karpelès is studying. The device had never sent funds to an attacker, and it is unclear whether the implant failed or the attackers were simply waiting.
Ledger has not confirmed any European case, and CryptoBilis has not publicly responded to requests for comment. Binance co-founder Changpeng Zhao alleged on X that the attackers apparently bought the reseller itself and made it sign a non-disclosure agreement. That claim has not been independently verified and should be treated as speculation.
What Ledger is telling customers to do
Ledger’s guidance is blunt, and it depends on what stage you are at:
- Do not initialize an unused device if you bought any hardware wallet through CryptoBilis in the last few months.
- If you already set one up, move your funds now to a brand-new device obtained directly from Ledger, generating a brand-new recovery phrase yourself.
- Restoring your old phrase onto new hardware does not help if the phrase was ever displayed on a tampered screen, because the attacker may already have it.
Ledger also repeated a warning that matters in every breach: the company will never call you, DM you, or ask for your 24-word recovery phrase. Scammers reliably exploit incidents like this with fake Ledger websites and apps asking for seed phrases, so any such request is a fraud attempt.
Why this one feels different
Crypto has seen hardware-related losses before. In July 2026, a flaw in Coldcard’s seed-generation firmware let attackers drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers. But this Ledger case is a physical supply-chain attack: a circuit board added to the device itself, somewhere between the manufacturer and the end user, with the goal of capturing the one secret the entire security model depends on.
It also lands at a moment when trust in self-custody is the industry’s central sales pitch. After millions moved to hardware wallets following the 2022 exchange failures, the pitch was simple: offline keys cannot be phished or hacked at a server. That is still mostly true of genuine devices bought directly from the manufacturer. But it depends entirely on the chain of custody between the factory and your desk, and this incident shows how thin that chain can be.
For background on how supply-chain attacks reach users through a different route, our recent coverage of the Midnight Mimosa malware arriving preinstalled on budget Android phones covers a similar pattern in mobile, and the GhostAction attack on GitHub Actions shows how attackers poison trusted tooling pipelines. The Double Counter Discord breach is also worth reading for how phishing and scam waves follow every major incident.
FAQ
Did Ledger itself get hacked?
No. Ledger says its internal systems, manufacturing, and direct sales channels were not compromised. Every confirmed case so far involves devices sold through the reseller CryptoBilis in Southeast Asia.
How do I know if my Ledger is affected?
If you bought your device through CryptoBilis in Indonesia, Malaysia, or the Philippines, treat it as suspect. Ledger advises not initializing unused devices and moving funds to a new device from Ledger with a freshly generated recovery phrase.
What should I do if my funds were stolen?
Contact official Ledger Support directly, file a complaint with local law enforcement, and preserve any transaction records. Moving remaining funds to a clean device with a new seed phrase is the immediate priority.
Are Ledger wallets bought directly from Ledger safe?
Ledger says its direct sales channels are unaffected, and researchers’ on-chain tracking aligns with that so far. The standard advice remains: buy hardware wallets only from the manufacturer or a verified official channel, and never enter your recovery phrase anywhere but the device itself.
What is CryptoBilis saying?
CryptoBilis has suspended all hardware-wallet sales until the investigation concludes and has promised an update around October 14 to 15. It has not publicly responded to the tampering allegations.