Criminals stole about $90 million of crypto by hiding password-reading components in Ledger devices sold through the reseller CryptoBilis. Ledger says its own systems were not compromised and tells buyers from that reseller not to set up their devices.
Criminals stole $90 million of crypto by hiding password readers inside USB-like devices, according to the Financial Times. Estimates of the total damage run from $90 million to $93 million, drained from more than 300 user wallets.
The devices were Ledger hardware wallets sold through CryptoBilis, an authorized reseller operating in Southeast Asia. The thefts began on or around October 9, 2026, and most victims were in Southeast Asia.
How the tampering worked
Ledger said organised criminals over several months bought genuine devices, opened them and fitted hidden components designed to capture the recovery phrase during set-up. They then put the devices back into distribution through resellers in south-east Asia, the company said.
The implants reportedly sent the stolen data out using LTE and eSIM technology, bypassing the owner's computer and Wi-Fi. Anyone holding the 24-word recovery phrase can rebuild the wallet on another device and move the funds.
Ledger described the theft as "one of the most sophisticated attacks" the crypto industry has seen, according to the FT.
Ledger, CryptoBilis and Tether respond
Ledger said its own systems were not compromised and that the attack hit the distribution channel after the devices left its control. The FT reported that all affected devices came from CryptoBilis, a reseller based in Malaysia, which has paused all sales and shipments of Ledger devices.
The company has also told customers that anyone who bought a device from CryptoBilis within the past 90 days should not initialize it. Setup is the moment the recovery phrase appears on screen.
Meanwhile, Tether, the issuer of the USDT stablecoin, has frozen USDT linked to the compromised wallets. Bitcoin and other decentralized tokens have no issuer that can pause transfers, Crypto Briefing noted.
Rivals tighten reseller checks
Trezor, a competitor, is reducing the number of resellers it works with so that it can vet every partner, the FT reported. Separately, about $116 million was stolen from Coldcard wallets in August after hackers exploited a flaw in the system.
Sources: Crypto Briefing, Financial Times
Trading involves risk.
Risk Disclaimer
