Ledger says every confirmed case in an October 2026 cryptocurrency-draining incident involved hardware wallets sold by Southeast Asian reseller CryptoBilis, after an unauthorised physical implant was found in one affected device.
The company said its own systems and direct sales channels had not been implicated. CryptoBilis, which was listed as an authorised Ledger reseller in the region, paused hardware wallet sales while the investigation continued.
Ledger’s 72-hour public update said the number of affected devices appeared limited and linked the confirmed cases to the 9 October incident. Its 11 October statement said it was working with authorities and contacting users.
Independent blockchain investigators have estimated losses of more than $86m, although Ledger has not confirmed that figure or published a final total. Estimates may change as analysts identify additional wallets, remove unrelated transactions and revise asset valuations.
The investigation has not established how every affected device was altered, where in the supply chain the modification took place or how many units were involved.
How the wallets may have been compromised
A hardware wallet is designed to generate and use private keys away from a general-purpose computer. During its initial setup, however, the owner must view and record a recovery phrase.
Reporting on the examined device described a small circuit board beneath the screen and claims it could collect and transmit displayed information. Ledger has confirmed the presence of an unauthorised implant in one device, but has not publicly established that every affected wallet used the same method.
If a recovery phrase is captured, an attacker can recreate the wallet on another device or compatible software and transfer funds without the original hardware being connected. Those transactions may appear valid on the blockchain, which would show the movement of funds but not how the phrase was obtained.
A device-authenticity check can verify particular components, firmware and cryptographic responses. It does not necessarily prove that no additional circuit has been attached outside the area inspected by the check. Tamper-evident packaging can also be opened or replicated, and is not the same as a complete record of custody.
Advice for affected customers
Ledger advised people who recently bought devices through CryptoBilis not to initialise unused wallets. Anyone who has already set up a potentially affected device should consider moving assets to a trusted replacement with a completely new seed. Transferring funds to another address linked to the same recovery phrase would not remove the risk.
Customers should use Ledger’s verified support channels and never enter a recovery phrase into a website claiming to test or validate a device. The incident has also created a risk of phishing attempts.
The exact point of tampering remains unknown. A device may pass through distributors, warehouses, importers, marketplaces, resellers and delivery companies before reaching its owner. The investigation will need to establish the affected models and batches, examine serial numbers and distribution records, and connect physical evidence with verified on-chain losses.
Ledger’s direct sales channels remain unaffected in its confirmed account, but the company’s statements are limited to the cases identified so far. The final number of compromised devices, the verified loss total and the responsibility for the alteration have yet to be determined.
