In Brief:
- A security incident affecting Ledger hardware wallets involves an unauthorized implant that records recovery phrases while the device is being set up.
- Losses tracked so far top 102 million USD, hitting wallets on Bitcoin, Ethereum, and TRON.
- Each confirmed case leads back to units sold by CryptoBilis, an authorized reseller operating in Southeast Asia.
Incident Overview
Ledger Donjon, Ledger’s security research unit, published details of the breach on October 13. The incident itself started on October 9. Some hardware wallets were fitted with an unauthorized implant that captures the 24-word recovery phrase shown on screen during setup. A hidden eSIM then sends that phrase out over LTE. With the phrase, attackers can rebuild the wallet on another device and empty it.
Scope of the Losses
Blockchain investigator Specter puts the losses at more than 102 million USD, and onchain data shows the stolen funds moving across several chains. Bitquery’s analysis found 324 compromised wallets. More than 80% of them have received funds since June 2026, which suggests the devices were exposed for longer than first estimates indicated.
Connection to CryptoBilis
Every verified case involves a device bought from CryptoBilis, an authorized reseller in Malaysia, Indonesia, and the Philippines. Ledger said units sold through its own direct channels were not affected. As a precaution, Ledger stopped selling through CryptoBilis. The reseller has halted all hardware wallet sales and closed its physical stores while it carries out an internal review.
Tampered Devices in Europe
Similar tampering has also been reported in Europe. Security researcher Johannes shared photos of a Ledger Nano X containing extra wiring that genuine units do not have. Another user discovered a tampered Ledger Stax with unauthorized components inside. Ledger has not confirmed that these devices are linked to CryptoBilis but says it is looking into further reports.
User Guidance
Ledger told anyone who bought a device from CryptoBilis not to initialize it and to reach out to support resources. People already using one of these wallets should move their assets to a secure device bought directly from Ledger. Anyone who suspects their device was tampered with should keep it for investigation and report it to local authorities.
Industry Response
Other wallet makers responded quickly. Trezor has dropped CryptoBilis from its list of authorized resellers, and OneKey is giving out free replacements for affected devices. Ledger CTO Charles Guillemet said the company will strengthen its reseller and security measures following the incident.
Implications for Web3 Gaming
Web3 gamers who keep their tokens and NFTs on hardware wallets should treat this breach as a warning. It shows why devices should be bought directly from the manufacturer and why buyers should watch out for counterfeit or compromised products. With potential losses above 102 million USD, the consequences are serious, and keeping assets secure remains essential.