Attackers reportedly planted hidden hardware in Ledger wallets sold through the Southeast Asian reseller CryptoBilis, and estimated losses run from $72 million to more than $93 million. Ledger says the problem is confined to that reseller channel, while parts of the story remain unconfirmed.
Attackers reportedly planted hidden hardware inside Ledger wallets sold through an authorized Southeast Asian reseller, CryptoBilis. Estimated losses range from $72 million to upwards of $93 million, spread across hundreds of wallets.
Ledger confirmed on October 10, 2026, that at least one affected device contained an unauthorized hardware implant. The company has told CryptoBilis to stop all sales and shipments of its devices.
How the attack allegedly worked
The implants are described as small circuit boards with cellular capabilities, placed behind the device screens. Their job was to capture a user's 24-word recovery phrase and send it out over cellular networks. Anyone holding those words can rebuild the wallet on another device and move the funds.
Researcher Mark Karpelès documented the hardware. According to his documentation, the findings point to several generations of the implants in devices bought in Southeast Asia.
A post on X went further, claiming the hackers bought a reseller outright and had it sign a non-disclosure agreement. Ledger has not confirmed that account.
Where the money went
The draining began around October 9, 2026. Researchers spotted significant inflows to theft addresses across several blockchains, including Bitcoin, Ethereum and Tether's USDT stablecoin.
Some of the stolen funds were reportedly routed through mixers such as Tornado Cash. Tether has reportedly frozen approximately $10 million in USDT linked to the theft addresses.
Ledger says the scope is limited
In an October 11 statement, Ledger said it has identified cases only with devices bought from CryptoBilis. According to U.Today, Ledger described the scope as limited: "The number of impacted devices is limited," without giving a precise count.
Blockchain investigators, meanwhile, estimate potential losses at over $86 million, though that figure is unconfirmed. Investigators are still determining whether the same changes caused all the reported thefts.
Ledger has also strengthened its supply chain security, including its authorized reseller system, and reminded distributors not to resell returned devices.
Sources: Crypto Briefing, U.Today
Trading involves risk.
Risk Disclaimer
