Ledger has confirmed that a hardware wallet belonging to one of the victims in a major Southeast Asian theft wave contained an unauthorized hardware implant. On-chain researchers estimate tha
Ledger has confirmed that a hardware wallet belonging to one of the victims in a major Southeast Asian theft wave contained an unauthorized hardware implant.
On-chain researchers estimate that more than $86 million has been drained from hundreds of wallets. Ledger says every confirmed case so far involves devices sold through one reseller, CryptoBilis, and that its own systems and direct sales channels are unaffected.
What Happened
On October 9, customers who bought Ledger devices through CryptoBilis began reporting unauthorized transactions. CryptoBilis is an official Ledger reseller serving Indonesia, Malaysia, and the Philippines. On-chain researcher tanuki42 first flagged more than $72 million moving to a group of suspected theft addresses.
Another researcher, Specter, later traced funds across Bitcoin, Ethereum, and Tron and put suspected losses above $86 million. MistTrack and Arkham Intelligence later put the figure closer to $90 million, and some outlets cite estimates up to about $93 million across more than 300 wallets.
Ledger has not verified any of these totals, and it remains unclear whether every theft in the estimates is tied to CryptoBilis customers.
The Cost for One Victim
Lookonchain described one of the most painful cases. The investor bought 80 BTC, worth about $5.2 million, four months ago at around $65,000 and was sitting on roughly $1.38 million in profit. A week ago he bought a Ledger from CryptoBilis and deposited all 80 BTC into it. Now, Lookonchain said, he has lost everything.
Ledger’s Response
Ledger acted on October 9 by asking CryptoBilis to pause all sales and shipments while it investigated. It advised anyone who bought a Ledger from this reseller in the past 90 days not to start setup if they had not already done so.
On October 10, Ledger issued a more serious update:
“Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger’s bounty program: [email protected].”
In a 72-hour update, Ledger said it is working with relevant authorities and that the volume of impacted devices is limited. It added:
“To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.”
CryptoBilis suspended sales of its entire hardware wallet inventory pending the review.
What Researchers Found Inside
Before Ledger’s confirmation, researchers had already been examining tampered units. Tibane Labs published a technical whitepaper describing a device with a microcontroller and cellular communication hardware, connected to the display’s internal data lines. According to security reporting, researchers including Joe Grand of Grand Idea Studio and the Tibane Labs team reverse-engineered compromised devices and identified three versions of the implant.
The reported mechanism is that the implant captures the recovery phrase while a user sets up the device. A recovery phrase is the 12 or 24 words that control the wallet, so anyone who obtains it can empty the wallet from anywhere. That would explain why victims lost funds without ever approving a transaction.
One important caution: Ledger has not confirmed that the implant caused the thefts, and the exact mechanism is still under investigation. The attack technique has been reported by researchers rather than confirmed by Ledger.
A Question About CryptoBilis
A statement shared with researcher Mark Karpelès and published by Tibane Labs said CryptoBilis completed a management transition in March and that the authors no longer control the company’s systems or customer databases. The statement does not establish who tampered with the devices or when, and that question remains open.
Why This Is a Different Kind of Attack
Most crypto thefts this year involved exchange hacks, smart contract exploits, or phishing. This one targets the hardware itself, before the user ever touches it. It is a supply-chain attack: the product is altered somewhere between the factory and your desk, which is why it can defeat even careful users who do everything right on their side.
It also targets the most trusted category of self-custody. Hardware wallets are marketed as the safest way to hold crypto because private keys stay offline. A tampered device undermines that promise if it is bought from an unverified or altered source.
What Ledger Users Should Do
Following Ledger’s guidance and standard security practice:
– If you bought from CryptoBilis in the last 90 days and have not set up the device: do not turn it on or initialize it. – If you already use a CryptoBilis-bought device: replace both the device and the recovery phrase, and move your funds to a new wallet created on a trusted device. – For everyone else: buy hardware wallets directly from the manufacturer or an officially verified channel, never use a device that arrives pre-initialized or with a recovery phrase already written down, and make sure the packaging seals are intact. – If you have information about the case: Ledger asks you to contact its bounty program at [email protected].
What Comes Next
The investigation is ongoing and Ledger says it is working with law enforcement. Key questions remain: how many devices were tampered with, where in the supply chain the implants were added, and whether the final loss total will match or exceed the current $86 million to $93 million estimates. Expect further technical findings from Tibane Labs and other researchers, a possible forensic report from Ledger, and tougher scrutiny of how hardware wallet makers vet and monitor their resellers.
