According to blockchain analysts at Bitquery, Ledger hardware wallet users lost at least $102M in October 2026 after buying their devices through CryptoBilis. At last count, 324 drained devices have been identified across several networks. The investigation uncovered a vulnerability that routine authenticity checks do not detect. Here is what we know so far.
Undetected Tampering
The first reports of missing crypto from Ledger buyers appeared on October 9. Users in Southeast Asia said funds had been withdrawn from wallets they bought through CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger opened an investigation, asked the reseller to suspend sales and advised recent buyers not to activate new devices while the review is under way.
On October 10, Ledger confirmed that an unauthorized hardware implant had been found in a device belonging to one affected user.
👀 Il montre comment ouvrir facilement sa Ledger pour vérifier qu’aucun implant espion n’a été ajouté à l’intérieur. https://t.co/sLszcbrLQf
Researchers, including Mark Karpelès of Tibane Labs, described how the attack targets the Ledger Nano X.
During initial setup, Ledger shows the user a 24-word recovery phrase. The implant intercepted the data traveling from the secure element to the screen, recognized the words and sent them to the attackers through its own modem with a SIM card and antenna.
“With the recovery phrase in hand, the attackers could restore the wallet on another device and move the funds. The implant did not touch the original secure element, so the wallet kept working, and Genuine Check could still verify its authenticity,” the experts said.
The board itself was hidden beneath the screen, with part of the internal gasket removed. The device and its packaging could still look untouched. Ledger warns that Genuine Check does not catch every physical modification, including implants that intercept screen data.
Researchers found several versions of the implants, from simple hand-soldered boards to complex flexible circuits with radio modules and antennas.
Components inside a Ledger that shouldn’t be there. Source: X
Similar modifications to the Ledger Nano X were reported in 2025–2026 as well. Joe Grand took apart one such device at the hardwear.io conference, and Karpelès examined units bought on Japanese marketplaces. So tampering with Ledger hardware did not start with the current attack.
Scale of the Losses
Bitquery estimated the damage at $102M and tied the attack to 324 wallets. An earlier estimate from Specter put the figure above $86M, while other analysts cited amounts between $91M and $93M.
Funds were withdrawn from wallets across six networks: Bitcoin, Ethereum, TRON, BNB Chain, Polygon and Solana. On TRON, USDT made up a large share of the stolen assets.
The speed of the transfers suggests the attackers may have prepared in advance. In some cases, several wallets were emptied at once, within seconds. This is consistent with the scenario in which the attackers had obtained the seed phrases ahead of time and waited for the right moment to move the funds.
Tether froze about $10M in USDT, but victims have yet to receive the stolen funds.
On October 11, Ledger said the number of affected devices is limited. The company said all confirmed thefts linked to the October 9 incident involved devices sold through CryptoBilis.
“There are no signs that internal systems were breached or direct sales were compromised,” Ledger said.
The company is working with law enforcement and reviewing its supply chain controls. In particular, it is requiring partners not to resell devices that customers have returned. Ledger is also developing additional hardware protection.
What We Know about CryptoBilis’s Owners
According to corporate records and statements from former co-founders, CryptoBilis, an authorized Ledger reseller in Southeast Asia, changed hands around March 2026. By August, the company was 100% owned by an individual using the pseudonym Jiaming, registered at an address in China’s Heilongjiang Province. The previous executives stepped away from day-to-day operations. Reports about the change in ownership also mentioned a non-disclosure agreement.
Binance co-founder Changpeng Zhao warned about the attack on October 9, calling it a localized supply chain problem.
“Based on the information available, this looks like a supply chain attack on a single seller. A small number of people probably bought fake or modified Ledger devices,” he wrote.
He also noted that Ledger remains a well-known and reliable manufacturer and advised against moving large sums into a new wallet right after buying it. Instead, he suggested leaving it without significant funds for a few weeks while following the news.
Later, after news of CryptoBilis’s ownership change emerged, Zhao wrote:
“The craziest part is that the hackers apparently bought the reseller and made them sign an NDA so everyone would stay quiet.”
Sold in a theft-proof box, yet they’re the ones doing the stealing. Source: X
So far, no evidence has emerged that CryptoBilis’s new management was involved in installing the implants. The former co-founders have distanced themselves from the company’s current operations.
What Experts Say
Karpelès and other specialists helped draw attention to the hardware implants by publishing their findings.
Bitcoin developer and security specialist Peter Todd said he had criticized Ledger’s authenticity check in the past: it could not rule out tampering with the device’s interface by an attacker.
“A few years ago, I argued with Ledger that relying on their authenticity scheme was foolish, since it could not detect a man-in-the-middle attack on the user interface. I argued that devices need tamper protection during delivery. Looks like I was right, as usual,” Todd wrote.
Lorenzo Valente, director of digital asset research at Ark Invest, urged people against buying hardware wallets from resellers, even officially authorized ones, as the investigation into thefts from Ledger buyers continues.
“At the very moment everyone is worried about ECDSA and cryptography, an incredible story involving data losses at Ledger is unfolding. The full version of events is not yet confirmed, but it is quite scary,” he said.
Our Take
The paradox here is that a wallet could protect a key and, at the same time, show it to a spy module inside its own case.
This new type of attack shows that you don’t need to break a device’s defenses: it is enough to simply eavesdrop on its screen. There is no social engineering and no cracked cryptography here. This is a hardware implant that intercepted the seed phrase during setup and could transmit it over a cellular connection.
The attackers worked the implant into the device’s hardware so carefully that both the wallet and its packaging looked untouched. In that situation, users had almost no way of suspecting tampering.
What stands out is that Ledger has yet to link losses of more than 100 million to its compromised devices.
Another paradox. Incidents like this could push some users back to custodians. For years, the market moved away from them toward self-custody. Now the argument for an intermediary is returning: if funds are lost, there is at least someone who is accountable and may carry insurance against the risk. In this sense, decentralization has yet to arrive.
This post is for informational purposes only and does not constitute advertising or investment advice. Please do your own research before making any decisions.
