On October 10, 2026, Ledger confirmed that hardware wallets sold by reseller CryptoBilis contained unauthorized hardware implants that compromised user security before devices left the box. The discovery marks the first confirmed case of a physical implant in a Ledger device linked to a reseller.
Attackers used the implants to gain access to users' recovery phrases, enabling them to drain funds across multiple blockchains. Estimated losses range from $72 million to $93.2 million across 311 to 315 compromised wallets.
Scope of the Breach
The affected devices were purchased from CryptoBilis within the three months preceding the announcement. Approximately $70 million of stolen funds were held in USDT on the Tron blockchain. The remaining losses were spread across Bitcoin, Ethereum, BNB Chain, Polygon, and Solana.
Ledger stated that its own systems and direct sales channels were not affected by the compromise.
Response and Recovery Efforts
Ledger instructed CryptoBilis customers not to initialize unused devices and to generate new seed phrases before moving assets. CryptoBilis has ceased operations pending investigation and may have undergone an ownership change.
Tether froze approximately $10 million in USDT tied to the incident. However, this recovery represents only a fraction of total estimated losses, and funds drained on decentralized blockchains such as Bitcoin cannot be recovered through centralized intervention.
Supply Chain Vulnerability
CryptoBilis operated as an authorized reseller of sealed Ledger devices across Indonesia, Malaysia, and the Philippines. The incident demonstrates how each additional distribution channel creates potential points where hardware could be intercepted, modified, and resealed before reaching customers.
Implications for Users and Industry
Buyers who purchased devices through resellers should verify the source of their hardware. Those who obtained units from CryptoBilis should follow Ledger's guidance and treat existing seed phrases as compromised. Key developments to monitor include the outcome of investigations into CryptoBilis operations, clarification on possible ownership changes, updates to wallet or loss counts, and additional asset freezes or tracing efforts that could affect victim recovery.
