Criminals stole approximately $90 million in cryptocurrency by inserting unauthorized hardware implants into Ledger hardware wallets sold through CryptoBilis, an authorized reseller operating in Southeast Asia. Estimates of total losses range from $90 million to $93 million, with more than 300 user wallets affected.
The attack targeted the physical hardware supply chain rather than blockchain networks or wallet software. Microcontroller implants were reportedly added to devices before reaching customers, designed to capture sensitive information displayed on wallet screens during the initialization process.
How the Attack Operated
The implants captured the 24-word recovery phrase generated when hardware wallets are initialized. This master backup phrase allows anyone possessing it to rebuild a wallet on another device and access funds. The microcontrollers used LTE and eSIM cellular technology to transmit stolen data, creating a private communication channel independent of the owner's computer or Wi-Fi network.
The coordinated thefts began on or around October 9, 2026, with most victims located in Southeast Asia, matching the reseller's geographic footprint.
Company Response and Mitigation
Ledger confirmed that at least one device was compromised and stated that affected devices are limited to those sold by CryptoBilis. The company advised customers who purchased devices from CryptoBilis within the past 90 days not to initialize them, preventing the implants from capturing recovery phrases during setup.
Tether, the issuer of USDT stablecoins, froze USDT linked to compromised wallets. Because stablecoins are centrally issued, issuers can block specific addresses from moving tokens. This protection does not extend to decentralized cryptocurrencies like Bitcoin, which have no issuer capable of freezing funds.
Supply Chain Vulnerability
Hardware wallets are engineered to resist external attacks including malware, phishing, and compromised browser extensions. A supply-chain attack alters this dynamic by compromising devices before users receive them, rendering downstream security features ineffective.
The CryptoBilis case highlights a paradox in hardware wallet security: purchasing from authorized resellers is standard advice for avoiding tampered equipment, yet these devices originated through an official channel.
