Tampered Ledger wallets sold by reseller CryptoBilis drain crypto via hidden implants

On 10 October 2026, Ledger confirmed that at least one hardware wallet sold through its Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, acknowledging a supply-chain compromise that on-chain analysts linked to the theft of tens of millions of dollars in cryptocurrency. Ledger had first acknowledged the reports a day earlier, on 9 October, as most of the recorded drains occurred between 9 and 10 October.

CryptoBilis presented itself as the authorized Ledger reseller for Malaysia and sold the devices across Malaysia, Indonesia and the Philippines. Ledger asked the reseller to pause all sales and shipments, and CryptoBilis suspended sales of its hardware-wallet stock pending the investigation. Ledger said the compromise appeared limited to devices sold through the reseller and that it had no indication its own security infrastructure, systems or services had been breached; the company said it was working with law enforcement and the SEAL 911 crypto-security collective and was developing further anti-tampering measures.

The implant

The mechanism remains reported rather than confirmed by Ledger. Mark Karpelès, the former head of Mt. Gox, posted photographs of a still-shrink-wrapped Ledger he said he had bought in Malaysia, showing a second circuit board in the screen area. He described a microcontroller, antenna and a cellular module with a data eSIM, and claimed the chip watches the display, recognises the device-setup screen, and transmits the user's 24-word recovery phrase over the mobile network — meaning a victim could lose funds simply by setting up a device that looked factory-sealed. Ledger has not endorsed this description, and Karpelès has not said his unit came from CryptoBilis.

Losses

Estimates of the stolen funds vary. On-chain analysts put the total at more than $86 million spread across hundreds of wallets on Bitcoin, Ethereum and other chains, while the analytics firm Bitquery estimated roughly $92.9 million across 311 wallets; the overall range reported ran from about $72 million to upwards of $90 million. None of these figures has been confirmed by Ledger. The company urged anyone who bought a Ledger through CryptoBilis in the past 90 days to stop using the device if not yet set up, and otherwise to move funds to a new Ledger with a freshly generated recovery phrase, stressing that a genuine wallet never ships with a recovery phrase already written down and that Ledger will never ask for the 24-word phrase.