The story began on October 9 as an investigation and became a confirmed hardware attack within four days. Ledger, the Paris-based maker of hardware wallets, said it was investigating reports that users in Southeast Asia lost crypto after buying devices from an authorized reseller called CryptoBilis. By October 13, its Donjon security team had confirmed that devices sold by that reseller contained unauthorized LTE implants that copy the user's recovery phrase.

What the implant does

According to The Block's report on Ledger's findings, the implant captures the 24-word recovery phrase when the user sets up the device and sends it out over a provisioned eSIM. That is the whole attack: a hardware wallet's security rests on the recovery phrase staying private, so anyone who has it can empty the wallet from anywhere. Ledger says the implant does not modify the device's Secure Element or Ledger's operating system, and does not tamper with transactions or signatures. In other words, the chip sits beside the wallet and listens, rather than breaking it.

That distinction matters for how to read the incident. Ledger says it has no sign that its own infrastructure, systems, or services were compromised, and on October 12 it said all confirmed cases are tied to CryptoBilis and that its own systems and direct sales were unaffected. This looks like a supply-chain tampering problem rather than a flaw in the wallet's design. It is also the kind of problem the original product promise, that you control your own keys, is least able to defend against if the keys are generated on a compromised device.

The losses, carefully read

The $86 million figure comes from onchain investigators, not from Ledger. A pseudonymous investigator, Specter, traced theft addresses that victims flagged on X and Reddit and found inflows from hundreds of victim wallets across Ethereum, Tron, and Bitcoin. Decrypt reported that Arkham data shared by Specter showed nearly $87 million at those addresses: roughly $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT. Both Decrypt and The Block note that Ledger has not verified the total or the number of victims, and Decrypt cautions that it is unclear whether every theft traces to the reseller. Other outlets have cited higher figures, and we have not been able to confirm them.

The retail and rival fallout

The incident has spread beyond Southeast Asia. The Block reports that MediaMarkt Saturn, the European electronics retailer, stopped selling Ledger devices in its stores and online on October 13, after a German customer reported an implant in a unit. No fund loss was reported in that case. An X user also claimed that two devices bought at separate MediaMarkt stores contained unauthorized cables and cellular modules, and a well-known crypto figure, Mark Karpelès, said a Ledger Flex bought at Singapore's airport contained a spy implant. Ledger has not confirmed a link to either of those, and we treat them as unverified.

Rivals moved quickly. Trezor said it has found no tampered CryptoBilis devices and no sign its products were affected, removed CryptoBilis as a precaution, and is shrinking its reseller network; resellers being cut lose authorization on January 1, 2027. OneKey said it has no customer fund losses, revoked CryptoBilis's authorization, and is offering free replacements for devices bought through the reseller between March 1 and October 13, 2026.

What users can do

Ledger's guidance is specific. Anyone who bought from CryptoBilis in the past 90 days should not set up the device. Anyone who already did should consider moving funds to a new signer with a new seed phrase. And anyone who lost funds should contact law enforcement before opening the device, because the hardware is evidence.

The broader lesson is about where a device comes from. A hardware wallet generates and stores your keys, so a device that was altered before it reached you cannot be trusted by design. Buy directly from the manufacturer or its verified storefront, check that the packaging is intact, and treat any device that arrives with a printed or pre-filled recovery phrase as compromised. Our earlier look at whether the seed phrase era is ending covers the alternatives, and our glossary defines self-hosted wallets.

Why it matters

This follows a year of key-management failures that were not exploits of code: the $116 million Coldcard firmware flaw was a build error, and our report on 2026's hack data shows how many losses start with people and processes rather than smart contracts. The CryptoBilis case adds a new layer, the retail channel. The strongest wallet is only as safe as the path it took to the buyer's hands. Ledger's investigation is continuing, and the final scale of the losses is still unknown. This is reporting, not security or investment advice.

Further reading

Frequently asked

What did Ledger confirm?

On October 13, Ledger's Donjon security team confirmed that hardware wallets sold by the Southeast Asian reseller CryptoBilis contained unauthorized LTE implants. According to The Block's report, the implant captures the 24-word recovery phrase during device setup and sends it out over a provisioned eSIM. Ledger says the implant does not alter the Secure Element or Ledger's operating system and does not change transactions or signatures.

How much was stolen?

Onchain researchers have estimated losses above $86 million across Bitcoin, Ethereum, and Tron. Ledger says it has not verified that figure or the number of affected users. Arkham data shared by the investigator Specter showed nearly $87 million at the flagged addresses, about $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT, though it is unclear whether every theft is linked to the reseller.

What should I do if I bought a Ledger from a reseller?

Ledger advised anyone who bought from CryptoBilis in the past 90 days not to set up the device. Those who already did should consider moving their assets to a new signer with a new seed phrase generated on a device from a trusted source. Anyone who has lost funds was told to contact law enforcement before opening the device. In general, buy hardware wallets directly from the manufacturer and never use a device that arrives with a pre-written recovery phrase.