Threat intel
Ledger confirms implant in a reseller-sold hardware wallet
A Ledger device sold by Southeast Asian reseller CryptoBilis carried a hidden implant. How it reads seed phrases, and how to check and move your funds.
Ledger confirmed on October 10, 2026 that a hardware wallet sold through CryptoBilis, an authorised Ledger reseller in Southeast Asia, contained an unauthorised hardware implant. The confirmation came a day after customers who bought devices from the reseller, which sold in Indonesia, Malaysia and the Philippines, reported wallets drained on October 9. Ledger asked CryptoBilis to stop selling and shipping its devices, and the reseller has halted all hardware wallet sales. Ledger says its own systems and its direct sales channels were not compromised.
The losses are large but not yet settled. Blockchain analytics firm Bitquery put them at about $93.2 million from 315 wallets across six blockchains in its October 11 estimate, roughly $70 million of it USDT on Tron. Ledger has not verified that figure or published one of its own. If you or your company holds crypto on a Ledger bought from a reseller or a marketplace listing rather than from Ledger directly, the seed phrase on it should be treated as suspect until you have checked where the device came from.
How it works
A hardware wallet keeps the private keys in a secure element, a tamper-resistant chip that signs transactions without ever exporting the key. During setup the secure element generates a 24-word recovery phrase (the seed) and shows each word on the device screen so the owner can write it down. Anyone holding that phrase can rebuild every key on another device.
Ledger has not described the implant it found, but two teardowns of tampered Nano X units show how one works. Mark Karpelès, the former Mt. Gox CEO, says he bought a tampered Ledger in Malaysia: under the screen, where display padding normally sits, he found a small board carrying a microcontroller, an antenna, an LTE chip and an e-SIM. By his account the implant watches what the screen shows, captures the seed words and sends them out over the mobile network. He has not tied his unit to CryptoBilis; it came from a Chinese seller on a large marketplace, per BleepingComputer.
Tibane Labs examined two modified Nano X units bought in September through Japanese marketplaces. It describes the implant tapping the connection between the secure element and the display, reconstructing the words, and transmitting them through its own cellular modem and SIM. Earlier versions swapped in a smaller battery to make room; the newer one runs off the original battery and sits under the screen. Tibane states it has not tested a CryptoBilis device and has no evidence linking its specimens to that reseller.
Karpelès says his device arrived in intact shrink wrap and passed Ledger's Genuine Check. That matches Ledger's documentation: Genuine Check is a cryptographic test that the secure element is authentic, and it cannot detect unauthorised physical modifications while the original secure element is intact, nor verify the device's supply chain history. An implant that leaves the real chip in place and only listens to the display passes the check by design.
What attackers did
Ledger opened its investigation on October 9 after the drain reports and confirmed the implant on October 10. In a 72-hour update on October 11 it said every confirmed case tied to the October 9 draining involved devices sold through CryptoBilis, and called the number of affected devices "limited" without giving a count. It is working with authorities to identify who did it.
The on-chain pattern shows preparation. Bitquery found small test transactions in the weeks before the main theft, and 25 Tron wallets signed the same token approval within three seconds during the coordinated withdrawal on October 9. That fits an attacker who collected seed phrases as victims set up their devices, then waited until the wallets held enough to sweep. Tether has frozen about $10 million of the stolen USDT, according to Bitquery's October 11 update; funds taken on Bitcoin have no issuer able to freeze them.
Estimates differ by method: Galaxy Digital's Alex Thorn put losses at about $91 million on October 9, and the first analyst figures were near $72 million. When CryptoBilis first stocked tampered units, and whether any other reseller is affected, is not public. A claim on X that devices sold through a European retailer were also implanted is unverified, and Ledger has not commented on it.
What to do
1. If you set up a device bought from CryptoBilis, or any reseller you cannot vouch for
Assume the recovery phrase is known to someone else. A firmware update or a new PIN on the same device does not help, because the words have already gone out over the implant's own radio. Ledger's advice is to buy a new device directly from Ledger, generate a new seed on it, and move all assets to the new addresses.
Do it in this order: set up the new device and record its phrase; move the largest balances first, chain by chain, including tokens on Tron, Ethereum and any sidechains; then revoke token approvals the old addresses granted, since an approval lets a spender pull tokens without a new signature. Leave nothing on the old phrase. To see whether you were already hit, look up each old address in a block explorer for outgoing transfers and token approvals you did not make, and do not import the old phrase into any software wallet to check it.
2. If the device is still sealed
Do not initialise it. Bitquery reads Ledger's advice as covering CryptoBilis purchases from roughly the last 90 days. Contact Ledger Support through official channels, and file a report with local police if you lost funds. Ledger says it will never call you, send a direct message or ask for your 24-word phrase, and scammers are already using the incident as a pretext to ask for one.
3. Checks for every new device
Ledger's buying guidance says not to use a device that arrives with a PIN already set, with a recovery phrase printed on a card or filled in on the sheet, or with packaging that looks opened or altered. Run Genuine Check only from the official Ledger Wallet app, because counterfeit software can report any hardware as genuine. Neither an intact box nor a passing check caught the implant Karpelès found; he says only opening the case revealed it, which is not a practical test for most buyers.
On marketplaces, check the "Sold by" name. Ledger notes that in some jurisdictions the "Ledger Authorized Store" listings on Amazon, Shopee and Lazada are run by resellers, so the storefront name alone does not tell you who handled the box.
4. If your company holds crypto
List every signing device with its model, serial number, supplier and purchase date, and move any that came through a reseller onto new devices bought from the manufacturer. Unbox and initialise new signers with two people present and record who did it and when. For treasury amounts, use multisig with keys on devices from different manufacturers, so one tampered unit cannot move funds alone. Write the incident playbook now: who decides to rotate, which addresses move first, and who contacts issuers such as Tether or Circle to request a freeze.
The wider lesson
The gap this incident exposed applies to firewalls, servers and laptops bought through distributors too: a valid firmware signature or a genuine chip does not mean the board around it is unmodified. Procurement rules that name approved sources, and a record of where each security device came from, belong in the same control set as the signature checks.
Our safeguarding and hardening work covers key custody and device procurement as well as configuration, and our security operations team can watch treasury addresses and approvals for movements nobody signed off. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Help Net Security, BleepingComputer, Crypto Briefing, CryptoSlate, Gridinsoft, TFTC, Ledger Academy: buying a Ledger signer securely, CoinPaper.