$86M Ledger Theft: Implant Found in Wallet Sold by Reseller CryptoBilis

Hardware wallets are supposed to be the safe place to keep crypto. This week, Ledger confirmed that at least one of its devices was sold with an unauthorized hardware implant inside, and the losses are large. On-chain researchers estimate that $86 million to $93 million has been drained from more than 300 wallets.

Ledger says every confirmed case so far involves devices sold by CryptoBilis, a reseller in Southeast Asia. The company says its own systems and its direct sales channels were not compromised.

Based on Ledger's statements on X as quoted by CoinDesk, BleepingComputer and The Verge, Ledger's own buying-safety guide, and reporting by The Block, checked October 13, 2026. Ledger has not confirmed any loss figure; the dollar amounts and wallet counts come from outside researchers.

What Ledger has confirmed

The timeline, pieced together from Ledger's posts as reported by news outlets:

• October 9: Ledger said it was looking into reports of missing funds and asked CryptoBilis to "pause all sales and shipments," The Block reported. Its support account told people who had bought from the reseller in the last 90 days to "not initiate set up if you have not done so yet."
• October 10: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant," Ledger Support posted, as quoted by CoinDesk.
• October 11: Ledger said that "to date, all confirmed cases related to the disclosed draining incident" involved devices sold through CryptoBilis. According to BleepingComputer, it described the affected volume as "limited."

Ledger also said there was "no indication" that its own security infrastructure or services had been compromised, CoinDesk reported. It added that it was cooperating with authorities and reviewing how it controls authorized resellers. CryptoBilis has suspended sales of its hardware wallet inventory while the investigation continues, according to Ledger.

CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines, according to The Block. It did not respond to CoinDesk's request for comment.

How many wallets, and how much money

Ledger has not published a loss total. The figures in circulation come from independent blockchain analysts:

• A researcher known as Specter estimated losses at "more than $86 million" across Bitcoin, Ethereum and Tron, The Block reported. Specter first said the funds came from "hundreds of victim wallets," then later said the exact number was not yet known.
• Another researcher, tanuki42, reported more than $72 million moved to suspected theft addresses, per The Block.
• CoinDesk, citing third-party on-chain researchers, put the range at $86 million to $93 million from more than 300 wallets.

Our own rough math: if around $86 million to $93 million came from roughly 300 wallets, the average loss would be about $290,000 to $310,000 per wallet. That is only an average across unconfirmed estimates. Individual losses almost certainly vary widely.

How the devices were compromised, as far as anyone has said

Ledger has confirmed an implant in one device. It has not published a technical breakdown or said how or when the tampering happened.

The descriptions so far come from outside researchers. The Verge reported that photos and videos posted online appear to show a small circuit board sandwiched under the screen. That implant allegedly reads what the screen shows, including the recovery phrase displayed during setup. It then uses an embedded SIM to send that information to the attacker.

BleepingComputer cited researcher Mark Karpelès and the firm Tibane Labs. They described an implant behind the display that captured screen output and button presses and sent data over a cellular connection. Those researchers referred to the Ledger Nano X. Ledger itself has not said which model was affected.

The catch: an "official" reseller was the weak link

The usual advice is to buy only from Ledger or an authorized reseller. CryptoBilis was an authorized reseller. That does not make the advice useless, but it means "authorized" is not a guarantee on its own.

Ledger's own guide to buying a device safely also spells out a limit of its Genuine Check, the in-app test that confirms a device is authentic. The check confirms the device contains a genuine secure chip, but it "cannot detect unauthorized physical modifications to the hardware" if that original chip is intact. In other words, a device can pass Genuine Check and still have an extra component added inside.

Other things are still unverified. Binance co-founder Changpeng Zhao alleged on X that the attackers bought the reseller. CoinDesk notes this has not been independently verified. It is also not yet public how many devices were tampered with or whether any were sold outside CryptoBilis.

If you bought from CryptoBilis: what Ledger says to do

• Not set up yet? Don't set it up. Ledger's advice covers anyone who bought from the reseller in the last 90 days.
• Already using it? Ledger says to "consider moving assets to a new Ledger signer (with a new seed)," as quoted by BleepingComputer. CoinDesk reports Ledger's advice is to use a device obtained from Ledger.
• Report it. Ledger told affected users to contact official Ledger Support and file a complaint with local police, CoinDesk reported.
• Watch for scammers. Ledger says it will never call you, message you directly, or ask for your 24-word recovery phrase.

A general safety checklist for any hardware wallet buyer

This is general guidance drawn from Ledger's buying-safety guide, not specific to this incident:

1. Buy from Ledger or a listed authorized reseller. Ledger keeps an official registry of resellers. On marketplaces such as Amazon, it recommends official Ledger storefronts or listed resellers.
2. Never use a pre-set recovery phrase or PIN. "A legitimate Ledger device never comes with a recovery phrase or PIN code pre-configured. Ever." If one arrives that way, don't use it.
3. Don't use a device whose package looks opened or altered. Contact Ledger Support instead. Ledger also notes that tampered packaging can look untouched.
4. Run Genuine Check in the official Ledger Wallet app. Download it only from Ledger. Ledger warns that counterfeit devices often come with modified versions of the app. Remember the check's limit described above.
5. Type your recovery phrase only on the device. Ledger says a genuine signer never asks you to enter it on a computer, phone, app or website.
6. Ignore surprise replacements. Ledger says legitimate replacements are never sent unsolicited.

Frequently asked questions

Was Ledger hacked?

Ledger says no. It says its internal systems and direct sales channels were not affected, and that all confirmed cases so far involve devices sold through CryptoBilis.

Is my Ledger safe if I bought it directly from Ledger?

Ledger says there is no indication that devices from its direct channels were affected. Following the checklist above still lowers your risk.

Will Genuine Check catch a tampered device?

Not necessarily. Ledger's guide says the check confirms a genuine secure chip but cannot detect physical changes to the hardware if that chip is intact.

Ledger says its investigation is ongoing. Until it publishes more detail, the safest assumption for anyone who bought from CryptoBilis is the one Ledger itself makes: treat the device as untrusted and move funds to a new seed.