What to Know

  • Ledger confirmed that one impacted user device contained an unauthorized hardware implant.
  • All confirmed cases tied to the disclosed draining incident of Oct. 9, 2026, involved devices sold through Southeast Asian reseller CryptoBilis.
  • On-chain researchers estimate that between $86 million and $93 million was stolen from more than 300 wallets across multiple blockchains.
  • Ledger says its internal systems, services, security infrastructure, and direct sales channels were not compromised.
  • CryptoBilis has suspended sales of all hardware wallet inventory while the investigation continues.
  • Ledger advised CryptoBilis customers not to initialize unused devices and told active users to move funds to a new seed on a device obtained directly from Ledger.
  • The company warned users that it will never call, direct message, or ask for a 24-word recovery phrase.

Ledger Identifies Physical Tampering in Wallet Loss Probe

Ledger has confirmed that a hardware wallet connected to recent user fund losses contained an unauthorized physical implant, escalating concerns about possible supply chain tampering in the self custody market. The confirmation centers on devices sold through CryptoBilis, a Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines.

In an update dated Oct. 10, Ledger Support said it could confirm that one of the impacted users’ devices contained an unauthorized hardware implant. A follow up update on Oct. 11 narrowed the known pattern further, with Ledger stating that all confirmed cases linked to the disclosed draining incident of Oct. 9, 2026, involved devices sold through CryptoBilis.

The company has emphasized that the number of confirmed impacted devices appears limited. It also said its internal systems, direct sales channels, services, and security infrastructure remain unaffected. That distinction is central to Ledger’s public response, because the case currently points to tampering in the distribution path rather than a breach of Ledger’s own technology stack or direct retail operation.

CryptoBilis Sales Halted as Investigation Continues

CryptoBilis has suspended sales of all hardware wallet inventory while the investigation proceeds. Ledger said it is actively contacting affected users and cooperating with relevant authorities. The company also reminded its distribution network to source products only through authorized channels and prohibited the restocking of returned products.

The discovery is significant because it provides the first concrete evidence supporting earlier market speculation that the losses could have resulted from physical tampering. Hardware wallets are designed to keep private keys offline, but their effectiveness depends not only on device design and firmware security, but also on the integrity of the manufacturing, shipping, storage, and reseller chain.

Ledger’s guidance to CryptoBilis customers is direct. Users who purchased devices through the reseller and have not yet initialized them are being told not to set them up. Users who already initialized a wallet are being advised to move funds to a new seed on a device obtained directly from Ledger. A new seed phrase is important in this context because moving assets to a new device without changing the seed could leave funds exposed if the prior setup process was compromised.

Researchers Estimate Losses Across Multiple Blockchains

Ledger has not confirmed an official loss figure. However, third party on-chain researchers estimate that between $86 million and $93 million was stolen from more than 300 wallets. The losses were tracked across multiple blockchains, including Bitcoin, Ethereum, and Tron.

Those estimates remain external to Ledger’s official confirmation, but they illustrate why the incident has drawn intense attention from crypto holders and security specialists. A theft spanning more than 300 wallets would suggest a pattern broader than a single user mistake, while the confirmed implant strengthens the possibility that at least part of the event involved compromised hardware before it reached customers.

Hardware wallet attacks can take several forms. Some target the seed generation process, some target user interfaces, and others attempt to manipulate the device before it is first used. In a physical implant scenario, the concern is that malicious components or modifications may alter how the device behaves, capture sensitive information, or undermine the trust assumptions that make offline signing secure.

Company Says Direct Channels Were Not Affected

Ledger has repeatedly stated that its direct sales channels were not compromised. That matters because customers who purchased directly from Ledger are not currently included in the confirmed case pattern described by the company. All confirmed cases so far, according to Ledger’s Oct. 11 update, involved devices sold through CryptoBilis.

The company’s framing does not eliminate all uncertainty. Investigations into hardware tampering can be complex, particularly when products may pass through warehouses, regional distributors, resellers, and end users before a compromise is discovered. Still, Ledger’s current position is that the issue is isolated to the batch distributed by CryptoBilis, and that the broader Ledger infrastructure remains intact.

Ledger also said the incident underscores the need to continuously review and strengthen distribution and anti tamper processes. The company said it is reviewing authorized reseller controls, advancing hardware protections, and calling for broader improvements in industry chain of custody practices. For self custody users, the case is a reminder that security begins before a device is even powered on.

Warnings Over Scams and Recovery Phrases

Ledger has warned that scammers often exploit high profile security incidents by impersonating support teams, contacting worried users, and asking for sensitive information. The company reminded customers that it will never call, direct message, or ask for a 24-word recovery phrase.

That warning is especially important during an active investigation. Users affected by uncertainty may be more likely to respond to fake help offers, malicious forms, or fraudulent recovery tools. The 24-word recovery phrase is the master credential for a wallet. Anyone who obtains it can move the funds controlled by that wallet, regardless of whether they possess the physical device.

Ledger has urged affected users to contact official Ledger Support and file complaints with local law enforcement. Customers who purchased through CryptoBilis should follow the company’s device specific guidance and avoid initializing any unused device from that reseller until more information is available.

Supply Chain Security Returns to the Spotlight

The incident has revived industry debate about whether self custody users can rely fully on physical devices purchased through reseller networks. Hardware wallets became a mainstream security choice after the collapse of FTX in 2022, when many investors moved assets away from centralized platforms and into self managed storage.

Self custody reduces reliance on exchanges and custodians, but it shifts operational responsibility to the user. That responsibility includes safeguarding a recovery phrase, verifying device authenticity, purchasing through trusted channels, and understanding the risks of preconfigured or previously handled hardware. The Ledger case highlights that even when users follow common security advice, chain of custody can become a critical point of weakness.

The broader market has seen other hardware wallet concerns in 2026. In July 2026, a flaw in Coldcard’s seed generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers. That event focused attention on firmware integrity, while the Ledger incident is centered on physical tampering connected to a reseller channel.

Unverified Claims Add to Market Speculation

Speculation continues over how the distribution chain may have been breached. Binance co-founder Changpeng Zhao alleged in a post on X that attackers apparently bought the reseller and made them sign a non-disclosure agreement to keep quiet. Those claims have not been independently verified.

CryptoBilis did not immediately respond to requests for comment regarding the incident or the specific allegations. Until investigators provide more detail, the exact mechanics of the suspected supply chain compromise remain uncertain. Market participants are therefore treating the confirmed implant as a serious development, while separating verified facts from unproven claims circulating on social media.

For now, the verified facts are narrower than the speculation. Ledger has confirmed an unauthorized hardware implant in one impacted user device, said all confirmed cases are linked to CryptoBilis sold devices, and maintained that its internal systems and direct channels were not affected. On-chain researchers have estimated large losses, but Ledger has not issued an official loss number.

What Users Should Do Now

Users who bought a Ledger device through CryptoBilis should avoid initializing any unused wallet, according to Ledger’s guidance. Those who already set up a device should move funds to a new seed on a device obtained directly from Ledger. That process should be done carefully, with the recovery phrase created fresh and stored offline in a secure location.

Users should also be wary of urgent messages claiming to offer recovery help. No legitimate support process requires disclosure of a recovery phrase. If funds are still present in a wallet believed to be at risk, the priority is to migrate assets safely to a newly generated seed using a trusted device, rather than interacting with unknown websites, callers, or social media accounts.

The case is likely to intensify scrutiny of reseller controls across the hardware wallet industry. As crypto ownership expands, users increasingly depend on specialized devices to protect assets. The Ledger and CryptoBilis investigation shows that security is not a single product feature, but a full chain of trust stretching from production to purchase to first use.

Frequently Asked Questions (FAQs)

What did Ledger confirm?

Ledger confirmed that one impacted user device contained an unauthorized hardware implant. The company said all confirmed cases tied to the disclosed draining incident of Oct. 9, 2026, involved devices sold through CryptoBilis.

Was Ledger’s internal system compromised?

Ledger says its internal systems, services, security infrastructure, and direct sales channels were not compromised. The company has framed the confirmed issue as linked to devices distributed through CryptoBilis.

How much crypto was reportedly stolen?

Ledger has not confirmed an official loss figure. Third party on-chain researchers estimate that between $86 million and $93 million was stolen from more than 300 wallets.

Which blockchains were affected?

On-chain researchers tracked losses across multiple blockchains, including Bitcoin, Ethereum, and Tron. Ledger has not published its own official total for the losses.

What should CryptoBilis customers do with unused devices?

Ledger advised CryptoBilis customers not to initialize unused devices. Users should wait for further official guidance and avoid setting up any device that may be part of the affected inventory.

What should users do if they already set up a CryptoBilis device?

Ledger told users with active wallets to move their funds to a new seed on a device obtained directly from Ledger. Creating a new seed is important because the old setup may be considered potentially exposed.

Has CryptoBilis stopped selling wallets?

Yes. CryptoBilis has suspended sales of all hardware wallet inventory while the investigation continues, according to Ledger’s updates.

Can Ledger support ask for a recovery phrase?

No. Ledger warned that it will never call, direct message, or ask users for their 24-word recovery phrase. Anyone requesting that phrase should be treated as a scammer.

Are claims about how the reseller was breached verified?

No. Claims circulating about how the supply chain may have been compromised, including allegations involving the reseller, have not been independently verified. The confirmed facts remain limited to Ledger’s statements and the ongoing investigation.