Ledger Hardware Implant Found in CryptoBilis Wallets: $86M Stolen

A hardware wallet exists to keep your crypto keys away from attackers. This week, that promise broke for hundreds of people in Southeast Asia. Ledger confirmed that at least one wallet sold by the reseller CryptoBilis carried an unauthorized hardware implant, and on-chain researchers say the thefts run past $86 million.

Ledger Wallets Sold by CryptoBilis Were Drained: Timeline of the Incident

Reports of drained wallets surfaced on October 9, 2026. The victims all bought their devices through CryptoBilis, a reseller that serves Indonesia, Malaysia, and the Philippines. Ledger opened an investigation and asked the reseller to pause sales and shipments.

On October 10, Ledger’s support account confirmed the key finding: one of the affected users’ devices contained an unauthorized hardware implant. A day later, Ledger said every confirmed case so far traces back to CryptoBilis. The company calls the number of affected devices limited. CryptoBilis has since stopped selling all of its hardware wallet inventory until the investigation ends.

Ledger states that its own systems, services, and direct sales channels show no sign of compromise.

How the Ledger Spy Implant Steals Your Recovery Phrase

Researcher Mark Karpelès, the former Mt. Gox CEO, opened a suspect Ledger Nano X from Malaysia and found extra electronics hidden behind the screen.

Reports describe the hardware as a small circuit board with a microcontroller, an LTE chip, an eSIM, and an antenna. It taps the data lines that feed the display. During setup, the screen shows your 24-word recovery phrase, and the implant reportedly reads those words and sends them out over the cellular connection.

This design sidesteps the wallet’s secure chip entirely. The device can pass as genuine, work normally, and still leak your phrase. Karpelès warns that an attacker may drain a wallet immediately or wait a year. Anyone holding the phrase can rebuild the wallet and move the funds without ever touching the device.

Ledger has not independently confirmed this exact method, and it has not said whether the implant caused every reported theft.

Can You Spot a Tampered Ledger? Why Intact Packaging Is Not Proof

The wallet Karpelès examined arrived in packaging that looked untouched. The extra component sat behind the display, inside the material that normally protects the screen. A quick look at the box or the front of the device would not have revealed it.

That is why Ledger’s advice does not rely on visual checks. If you bought through CryptoBilis, the safe path is a new wallet with a new recovery phrase on a device from Ledger’s own store. Some researchers urge buyers from other third-party sellers to open their devices and look for extra wires or boards. Opening a wallet takes skill, can damage it, and may void your warranty, so ask Ledger Support before you try.

How Much Crypto Was Stolen? $72M to $93M Across 300+ Wallets

Nobody has an official figure. Ledger has not confirmed a total, and independent trackers disagree:

Bitquery counts about $92.9 million across 311 wallets on Bitcoin, Ethereum, TRON, BNB Chain, and Polygon. Most of it is USDT on TRON, about $70.5 million, plus roughly $16.8 million in Bitcoin.
Yfarmx estimates $93.4 million across 471 addresses.
Specter traced more than $86 million from hundreds of wallets.
Security researcher tanuki42 started with a figure above $72 million.

Recovery efforts have started. Tether and law enforcement froze more than $10 million in USDT. Other funds moved through swaps and into Tornado Cash, including about 900 ETH in later transfers according to PublicAML.

Is the Ledger Implant Also in Europe? What Is Confirmed and What Is Not

On Sunday, crypto commentator Johannes posted photos of a Ledger bought from a European retail store a couple of weeks earlier. The images showed extra wires inside. Karpelès confirmed the find and said it looked like an earlier version of the implant he is studying, which suggests several iterations exist.

Treat this as unverified. Ledger has not confirmed any European case, and the device in question did not lose funds.

Who Tampered With the Wallets? Unanswered Questions in the Ledger Case

Several details remain unresolved:

Who installed the implants, and at what point in the supply chain.
How many devices carry modifications.
Which losses link directly to confirmed implants.
Whether a change of ownership at CryptoBilis played any role. Former executives Arravind Prabu and Vimalatheethan say they handed over operations in March 2026 and no longer control company systems or customer data. Binance co-founder Changpeng Zhao claimed on X that attackers bought the reseller and forced silence through an NDA. Nobody has verified that claim, and CryptoBilis has not responded.

What Ledger Owners Should Do Now: Seed Reset and Safe Setup Steps

Ledger’s guidance is direct:

Bought from CryptoBilis in the last 90 days and not yet set up? Do not start setup.
Already set up a CryptoBilis device? Create a new wallet with a new recovery phrase on a device bought directly from Ledger, then move your assets. Importing the old phrase into a new device does not help, because the phrase itself may already be exposed.
Bought from any unauthorized reseller? Be suspicious. Ledger says it cannot vouch for modified or counterfeit units from outside its authorized channels.
Found a theft? Contact official Ledger Support and file a report with local law enforcement.
Your recovery phrase must come from your own device. If a device ships with a phrase already printed or written down, treat the wallet as unsafe.

Watch for scams too. Ledger will never call you, message you, or ask for your 24-word phrase. Phishing sites and fake recovery services typically follow incidents like this one.

Hardware Wallet Supply Chain Risk: Lessons From Ledger and Coldcard

This attack hit the supply chain, not the product’s cryptography. The best defense is simple: buy hardware wallets only from the maker’s own store or a verified authorized seller, and always generate your own phrase.

Ledger says it is working on stronger anti-tamper protections and reviewing its reseller controls. It also wants better chain-of-custody practices across the industry. The incident follows a July 2026 Coldcard firmware flaw that reportedly let attackers drain an estimated $100 million to $130 million in Bitcoin, which shows how fragile trust in self-custody hardware has become.

We will update this article as Ledger and investigators release more details.

Ledger Wallets Sold by CryptoBilis Hid a Spy Implant, and Over $86 Million Has Vanished