Ledger reported an unauthorized implant in a device purchased through CryptoBilis. Independent loss estimates differ; Ledger has not confirmed a total. Ledger advised affected buyers to avoid
Ledger is investigating a Ledger wallet breach involving devices sold by Southeast Asian reseller CryptoBilis after discovering an unauthorized hardware implant. The company said confirmed cases linked to the October 9 wallet drains involved that reseller. CryptoBilis has suspended hardware wallet sales, while Ledger says its systems and direct sales channels remain unaffected.
Ledger Support disclosed the implant on October 10 after examining an affected customer’s device. Its Donjon security team is investigating, while the company checks for reports involving other distributors and regions.
Update from Ledger Donjon on the CryptoBilis investigation @DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.…
— Ledger (@Ledger) October 13, 2026
PANews reported that the component could capture screen content, recover setup seed words and transmit them through an LTE eSIM. That account also said the secure chip and transaction-signing process remained unchanged. These technical details could not be independently verified for this article.
In its October 11 update, Ledger described the affected device count as limited but provided no precise total. The statement did not establish where the tampering occurred or who inserted the component.
The Ledger wallet breach has also produced conflicting loss estimates. Bitquery reportedly tracked $93.2 million across 315 wallets on six blockchains. YFarmX estimated $103.4 million across 530 addresses on seven chains after its October 12 update.
Those figures reflect different datasets and remain separate from any company-confirmed total. Ledger had not published a loss figure in the supplied updates.
For customers affected by the Ledger wallet breach warning, Ledger advised against setting up unused CryptoBilis devices purchased within 90 days. Customers who already completed setup were advised to consider transferring assets to a new Ledger device with a fresh recovery phrase.
A replacement device using the same exposed phrase would not remove an attacker’s access. The distinction makes generating a new phrase central to the published guidance.
CryptoBilis warned customers against using recovery phrases supplied on preprinted or handwritten cards. It also cautioned that neither Ledger nor its staff would request a recovery phrase or PIN.
As the Ledger wallet breach investigation continues, the company says it is working with authorities and reviewing reseller controls. It has instructed distributors to source through authorized channels and never return previously sold devices to inventory.
Bitquery reported that Tether blocked 37 addresses linked to the theft, with approximately $10 million frozen across 20 addresses.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.<p>The post Ledger Wallet Breach Probe Finds Implant in CryptoBilis Device first appeared on Coin Crypto Newz.</p>
