Ledger has confirmed that at least one device belonging to an affected user contained an unauthorised hardware implant. According to the manufacturer, every confirmed case traces back to a si
Ledger has confirmed that at least one device belonging to an affected user contained an unauthorised hardware implant. According to the manufacturer, every confirmed case traces back to a single reseller in South-East Asia. Since 11 October, users have also been reporting devices bought from European retail, and that is where the case starts to matter for you: if the sales channel is the point of attack, the brand on the box counts for less than the question of whose hands your device passed through.
In a status report 72 hours after the incident, Ledger wrote on X that all confirmed cases of the theft disclosed on 9 October involved devices sold through the South-East Asian reseller CryptoBilis. The security publication Help Net Security documents that wording. The manufacturer also confirmed that one affected device contained an unauthorised additional circuit board.
Two things Ledger did not do. It did not explain how the implant works technically. And it did not give the number of affected devices. The company does state that its own systems and its direct sales channel were not compromised. Ledger says it is working with the relevant authorities and is contacting affected users.
That distinction is no side note. An attack on manufacturing would affect every device in a production run. An attack on one station in the distribution chain affects the devices that passed through that station. The difference decides how many people have to act, and so far the evidence points to the second case. How the incident began, we set out on 10 October in our review of the CryptoBilis case.
CryptoBilis is an authorised reseller and serves customers in Indonesia, Malaysia and the Philippines. The company had changed owner shortly before. Ledger told the retailer to stop sales and shipping; on the manufacturer's account, CryptoBilis has ceased selling hardware wallets.
The instruction Ledger then issued to all authorised retailers is the notable part: source goods only through authorised channels, and never return a returned product to the shelf. The second half describes the likely lever. A returned device, opened and resealed, looks like new stock in a shop.
A supply-chain attack does not hit the product at the manufacturer. It hits a station on the way to the buyer: warehouse, transport, returns processing, shop shelf. For buyers, that means the security of a hardware wallet does not begin when the device is first switched on.
The board Mark Karpelès showed publicly sits where the device normally holds nothing but the padding behind the display.
The most detailed technical description so far comes not from the manufacturer but from Mark Karpelès, the former head of the Mt. Gox exchange. He says he bought a tampered device himself in Malaysia and has published photographs and video. They show a small circuit board under the screen, in the place that otherwise holds only a piece of padding.
On his account, that board carries a microcontroller, an antenna, an LTE module and an e-SIM. An e-SIM is a permanently fitted, digitally writable SIM card; it needs no card slot and is invisible from the outside. Karpelès describes the component reading along with whatever the screen displays, capturing the recovery phrase in the process and sending it to the attacker over the mobile network.
The recovery phrase, also known as the seed phrase, is the sequence of 24 words from which every private key in your wallet can be recomputed. Anyone who knows it no longer needs your device. That makes setup, the moment when those words appear on the display once, the most valuable moment for an attacker. Ledger has not confirmed this account of how the implant works, and it rests so far on a single investigation, if a technically documented one.
Karpelès also reports a second suspect device, obtained through a listing on Amazon Japan with stock that came from Malaysia. That too points to the trade route rather than to manufacturing.
The most uncomfortable finding of the case concerns the very check buyers have relied on until now. The Genuine Check is the authenticity test in which Ledger's software runs a cryptographic key exchange with the secure chip inside the device and then confirms that the unit is genuine.
Karpelès says his tampered device arrived in intact shrink wrap and passed that test. The reason is obvious once you have heard it: the secure chip was real. The implant sits next to it and the check does not cover it. On his assessment, opening the device is the only reliable way to find the additional board.
There is an awkward consequence for everyday practice. A passed authenticity check is still a good sign, but it is not proof that nothing foreign sits inside the case. Anyone holding a second-hand device, or one from a channel with an unclear chain of custody, cannot rest on that signal alone. Which devices are built in what way, and where the differences lie, our hardware wallet comparison sets out.
There is no official damage figure. The on-chain analysts at Bitquery arrive at a suspected total of more than $93 million. Other independent assessments come out lower; the range of published estimates runs from around $72 million to more than $93 million, spread across hundreds of wallets. One analysis names $93.4 million across more than 300 addresses.
Balances on several blockchains are affected, with Bitcoin, Ethereum and Tron named. The figures diverge because of method: anyone attributing addresses to an incident has to decide which movements still belong to it. We therefore give the range and do not smooth the values into a single number.
The single finding that matters most to you is not the damage total. It sits in a time window. Bitquery traced the drained wallets back and finds that more than eight in ten first received a balance in June or later. That suggests devices bought at CryptoBilis as early as June can be affected too.
That reaches beyond Ledger's own advice. The manufacturer had told buyers from the past 90 days to move their holdings to a new device. Counting back from the incident on 9 October, that window ends in early July. The on-chain trail begins a month earlier. Anyone who bought a device through this retailer in June falls outside the manufacturer's recommendation, but not outside the data.
Between the production line and the shop counter sit stations that no buyer can trace one by one.
On 11 October a report from Europe became public. A user writing on X as @0xJohannes_ says he bought his device in a branch of an official European reseller; the channel Crypto Banter carried the case further the same day. On his description, the device held additional cables that do not appear in genuine units, and the build resembled an older variant of the implant even though the purchase was only weeks old. Karpelès, who posts on X as @MagicalTux, pointed to an antenna whose marking suggested a "Eurasian" version.
Care matters more than speed here. No balance was taken from this device. Which retail chain is meant does not emerge from the report itself. It is named only in adjacent coverage; the trade publication Crowdfund Insider writes exactly that and refrains from confirming the case itself. Ledger has not commented in detail on the European report and continues to attribute the confirmed cases to the South-East Asian retailer. Several observers regard the published images as insufficient evidence and warn against inferring broad contamination of European retail from individual cases.
Something is left for your decision all the same. There is one confirmed implant case, a documented route through the intermediate trade, and a manufacturer's instruction not to restock returns. That is enough to retrace your own purchase route once, and not enough to panic.
Ledger's recommendations for affected customers are clearly worded. Anyone who bought at CryptoBilis and has not yet set the device up should not initialise it. Anyone who has already set it up should move their holdings to a new device with a newly generated recovery phrase, ideally one bought directly from the manufacturer. Contact should run through the official channels, and the company explicitly recommends filing a report with the local police.
For the German market there is no confirmed case. The reports from European retail do give reason, though, to make the purchase route the criterion. Buying a device directly from the manufacturer, or from a retailer with a traceable supply chain, costs nothing but a little patience. A device from a marketplace, from a classified ad or as a return from unclear hands carries a risk that cannot be checked from the outside.
What you should not do matters as well: opening your own device to look for a board destroys the warranty and, without reference images and measuring equipment, gives you no reliable answer. The route via a new recovery phrase on a cleanly sourced device is cheaper and safer than any tinkering with the case.
This incident touches a decision many investors take once and then never revisit: self-custody or custody by a service provider. Self-custody means that you hold the private key yourself and nobody else can dispose of your assets.
The price is that there is no counterparty when something goes wrong. Anyone who loses a seed through a tampered device has no claim against a custodian. What remains is a damages claim against whoever tampered with the device, and that person is usually unknown. With a custodian authorised under the EU's MiCA regulation, the customer by contrast holds a claim against a supervised company, with duties to segregate client holdings. In exchange, that customer gives up the key. Which providers hold an EU licence, our overview of regulated crypto exchanges shows.
Both are defensible, and most investors fare better with a split than with a pure solution. What counts is knowing which part of your assets you answer for yourself if the worst happens.
Every major security incident is followed by a second wave, and it reaches more people than the incident itself. Ledger explicitly warns that fraudsters are exploiting the situation and makes one point clear: the company does not call, does not send direct messages and never asks for the 24-word phrase. Any message that does precisely that is an attack, however genuine the sender and the design may look.
The same incident has already pushed fake Ledger pages into search results. How to spot them, we set out in our analysis of the fake Ledger websites. The rule behind it is short: the phrase never leaves the device, on no channel, for no support agent.
In the market the news has moved little so far. Bitcoin trades at around $82,400 on CoinGecko data, a good one percent below the previous day, and the market as a whole lost about 3.7 percent in 24 hours. The incident is grave for those affected and, for the price, a side issue so far.
If a doubt about the purchase route remains, no test on the case will settle it. Only a fresh key on a device whose origin you know. These three steps get you there:
(As of October 12, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
