Ledger Confirms Hardware Implant in Reseller-Sold Wallets: How the CryptoBilis Attack Worked

Ledger says devices sold by Southeast Asian reseller CryptoBilis carried a hidden implant that read the 24-word recovery phrase and sent it over LTE. On-chain estimates put losses at $86M to $102M, a figure Ledger has not confirmed. Timeline, estimates and what users should do.

Oct 13, 2026 - 21:29

Updated: 18 days ago

Ledger Confirms Hardware Implant in Reseller-Sold Wallets: How the CryptoBilis Attack Worked

Comic-style illustration of an opened hardware wallet with a glowing red spy chip sending radio waves, gold Bitcoin coins, a magnifying glass and a torn package, with a city street and cargo port at sunset

Key takeaways

Ledger says hardware wallets ("signers") sold by CryptoBilis, a reseller in Southeast Asia, contained an unauthorized hardware implant. It confirmed the implant on October 10, 2026 for one affected user's device (Ledger on X, October 13).
According to Ledger's security team (Donjon), the implant sits inside the enclosure, reads the 24-word recovery phrase when it is displayed during setup and transmits it over LTE using a provisioned eSIM. It does not modify the Secure Element, the operating system, transactions or signatures.
Ledger says all confirmed fund losses from the draining incident disclosed on October 9 involve devices sold through CryptoBilis, that "the volume of impacted devices is limited" and that its own systems and direct sales channels "remain unaffected" (Ledger, October 11).
Ledger has not confirmed the amount stolen. On-chain investigators estimate it at $86 million to $102 million; Bitquery counts $102.0 million from 324 wallets on six chains (Bitquery investigation).
Our calculation from Bitquery's breakdown: 78% of the value drained was on TRON, mostly stablecoins, which is why issuer freezes matter in this case.

Background: our guide to how Bitcoin and private keys work explains why a recovery phrase is the single point of failure of any wallet.

What happened: a timeline from primary sources

Date (2026)	Event	Source
Oct 9	Wallets start being drained across several chains; on-chain analysts flag the pattern. Ledger opens an investigation and tells recent CryptoBilis buyers not to set up their devices.	Specter on X, Bitquery
Oct 10	Ledger confirms an unauthorized hardware implant in one affected user's device.	Ledger
Oct 11	72-hour update: all confirmed cases involve CryptoBilis devices; CryptoBilis "has confirmed having ceased all sales of hardware wallets"; Ledger is working with "relevant authorities".	Ledger
Oct 13	Donjon describes the implant. Ledger says it has not verified a drain linked to a device bought elsewhere and is "reviewing reports of implants in other signers and locations".	Ledger

How the supply-chain attack worked

Based on Ledger's description, the attack chain has four steps:

Tampering before sale. Genuine devices were opened and fitted with a separate component somewhere in the distribution chain. Ledger CEO Pascal Gauthier said the investigation is ongoing "to determine who tampered with these signers or where in the distribution chain it happened" (Gauthier on X, October 13).
Reading the screen. The implant watches what the device displays. During setup, the device shows the 24 recovery words.
Exfiltration over mobile data. The implant's microcontroller decodes the words and sends them over LTE using an eSIM, without the user's computer or phone being involved.
Draining later. With the recovery phrase, the attacker can rebuild the wallet on any device and move the funds. The Secure Element was never broken, which is why the device's own checks would not flag the implant.

The lesson is broader than one brand: a hardware wallet protects keys from a hacked computer, not from a physically modified device. That is why Ledger and other makers tell users to buy only from the manufacturer or an authorized reseller. Note that, according to press reports, CryptoBilis appeared on Ledger's own list of resellers, so the authorized channel itself was the weak point here.

How much was stolen? Comparing the estimates

Estimate	Amount	Wallets	Basis
Specter, on-chain analyst (Oct 9)	over $86M	n/a	BTC, ETH and TRON flows to attacker addresses
Bitquery (verified Oct 13)	$102.0M	324	Outflows from victim wallets on six chains, priced on Oct 9
Ledger	not confirmed	not confirmed	"Figures circulating online come from third parties"

Bitquery's breakdown by chain, with shares calculated by BullishStation:

Chain	Drained (US$M)	Share
TRON	79.3	77.7%
Bitcoin	16.8	16.5%
Ethereum	3.7	3.6%
BNB Chain	1.45	1.4%
Polygon	0.58	0.6%
Solana	0.25	0.2%
Total	102.1	100%

Source: Bitquery. Figures are third-party estimates, not confirmed by Ledger. Bitquery also reports that issuers froze part of the stolen stablecoins; see our explainer on how stablecoins work and why issuers can freeze them.

Perspective: TRM Labs counted about $1.73 billion stolen in 333 incidents in 2026 through September 8, and called the $319 million Liquid Network exploit "2026's biggest hack to date" (about 85% of those funds were later returned) (TRM Labs). At $86–102 million, the CryptoBilis case would be smaller than the largest protocol hacks, but it is unusual because it targets individuals through hardware rather than a smart contract or an exchange. For the software side of the threat, see our piece on AI and crypto security audits.

Who is affected and what Ledger tells users to do

Bought from CryptoBilis and not set up yet: do not set it up, and contact Ledger Support.
Bought from CryptoBilis and already set up: move assets promptly to a new device bought from Ledger, with a new recovery phrase. Do not restore any phrase on a CryptoBilis device.
Lost funds: contact Ledger Support via support.ledger.com, file a report with local law enforcement, and do not open or send the device to anyone before speaking with them.
Everyone: Ledger "will never call you, DM you, or ask for your 24-word recovery phrase". Expect phishing that exploits the news.

One caveat from the data: Ledger's first warning targeted buyers of the last 90 days, but Bitquery reports that most drained wallets were first funded from June 2026, which suggests the relevant purchase window could be wider. Ledger has not commented on this point.

Why it matters for markets

A loss of this size does not move Bitcoin's price on its own, but security incidents feed regulatory pressure on self-custody and on the businesses that distribute wallets, a theme that sits alongside sanctions enforcement such as the US move to seize $1 billion in Iranian crypto. It also comes as US regulators are writing custody rules for professionals: the SEC's crypto custody proposal for advisers and funds requires two-person authorization and documented key-management controls for any self-custody.

What to watch next

Coming days: results of Ledger Donjon's analysis of returned devices, and whether Ledger confirms implants outside CryptoBilis (Ledger update of October 13).
Coming days: any statement by law enforcement, and further freezes of stolen stablecoins tracked by Bitquery.
October 14, 2026, 8:30 a.m. ET: US September CPI, the next market-wide catalyst (our CPI and crypto tracker).

FAQ

Was Ledger hacked?

Ledger says no: its CEO wrote that it has "no indication" that its infrastructure, systems or services were compromised (source). The attack used physically modified devices sold through one reseller.

How do I know if my Ledger is affected?

According to Ledger, all confirmed cases involve devices bought from CryptoBilis. If you bought directly from Ledger or another reseller, Ledger has not verified any drain linked to your channel, but it is reviewing reports from other locations.

Does the Genuine Check detect the implant?

Ledger says the implant does not modify the Secure Element or the operating system, so software checks of the device are not designed to detect it. Ledger publishes a guide to inspecting a device physically, which can damage it.

How much money was stolen?

Ledger has not confirmed a figure. On-chain investigators estimate between $86 million and $102 million.

Sources

Related: UK court rules Chinese law decides claims to 61,000 seized bitcoin (October 14, 2026).

This article is for information only and is not investment or security advice. Follow the manufacturer's official instructions for your device. Crypto assets are volatile and you can lose all the money you invest. Information as of October 13, 2026, 20:00 UTC.