Ledger Tampered Wallet Thefts: What the Supply-Chain Attack Means for Your Hardware Wallet

Home » Ledger Tampered Wallet Thefts: What the Supply-Chain Attack Means for Your Hardware Wallet

October 16, 2026 0

Quick answer: Ledger confirmed on October 13, 2026 that some hardware wallets sold by a Southeast Asian reseller, CryptoBilis, contained a hidden cellular implant. During setup, the implant read the 24-word recovery phrase off the screen and sent it out over an LTE connection. Attackers then restored those wallets elsewhere and emptied them. Third-party trackers put the losses between roughly $86 million and $103 million, but Ledger hasn’t confirmed any total. The device’s Secure Element wasn’t what failed. The device was tampered with before it ever reached the buyer. If you bought a hardware wallet from an unofficial seller, that’s the part to take seriously.

What Ledger has confirmed

Ledger’s security team (Donjon) described the incident on October 13 as a “physical supply-chain attack,” according to CoinDesk and The Block, both reporting Ledger’s own statements. Ledger says it found an unauthorized implant inside the enclosure of at least one device sold through CryptoBilis, and that every confirmed loss in the October 9 drain involved a device from that reseller.

Here’s what Ledger says the implant did. When a user set up the wallet and the 24-word recovery phrase appeared on screen, a small microcontroller inside the case read the words. It then transmitted them over LTE using a provisioned eSIM. Ledger stresses that the implant did not alter the Secure Element or the operating system, and it did not change transactions or signatures. It also says it has no indication that its own infrastructure, software or services were compromised.

That distinction matters. The chip that guards your keys wasn’t cracked. Someone put a second, uninvited device next to it that watched the screen.

Ledger asked CryptoBilis to pause sales and shipments, and says the reseller has stopped selling its devices. Ledger’s investigation into who tampered with the units, and at what point in the distribution chain, is ongoing.

How big were the losses?

Nobody outside Ledger’s investigators knows yet, and Ledger itself says it hasn’t fully verified the figures circulating online. The estimates have also drifted upward as analysts traced more wallets.

Early on-chain estimates put losses above $86 million across Bitcoin, Ethereum and Tron, per The Block.
CoinDesk cited researchers estimating up to $93.2 million across more than 300 wallets.
Bitquery counted about $102 million from 324 wallets across six blockchains (TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon), as reported by Gizmodo and CoinTurk.
Another report cited by CryptoBreaking mentions about $103.4 million from 530 addresses, but that traces back to a social media post, so we’d treat it as unconfirmed.

Those numbers don’t agree, and they shouldn’t be read as a final tally. They’re different analysts counting different wallets at different times. What they share is the order of magnitude: tens of millions of dollars, drained from hundreds of wallets.

Two other details show up in the reporting. Tether reportedly froze $10 million in USDT tied to the theft. And Bitquery says about 6,680 ETH moved through Tornado Cash, with much of it later shifting into Zcash, though it rates some links in that chain as stronger than others.

The odd case of the scammer who got scammed

One victim stands out. Chainalysis reports that a suspected scammer, who ran what’s known as a “task scam,” lost about 60 BTC (roughly $4.8 million) after buying three new Ledger devices that carried the spyware. Chainalysis says all three wallets were drained into the same destination wallet, which it reads as a sign that the same threat actors controlled the compromised devices.

There’s an irony there, but it isn’t a reason to look away. It also tells you something useful: the attackers weren’t targeting a type of person. They were targeting anyone who set up a tampered device. Whoever bought one from that channel, careful or careless, was exposed.

One discrepancy to flag: the CoinTurk write-up has a table listing about $60 million in Bitcoin losses, which conflicts with its own text and with Chainalysis’s 60 BTC figure. We believe the table is wrong and are using the 60 BTC number.

Is this only a Southeast Asia problem?

Ledger says confirmed thefts are tied to CryptoBilis, which it describes as a limited volume, and it hasn’t verified a theft linked to a device bought elsewhere. But reports have appeared beyond that channel, and they’re worth stating carefully.

Germany: MediaMarkt Saturn, which runs about 1,070 stores across Europe, stopped selling Ledger devices in its stores and online after a German customer reported finding an implant. Ledger says no funds were lost in that case. An X user also posted photos of devices bought at MediaMarkt with extra cables and cellular modules. Those claims are unverified.
Singapore: Mark Karpelès, the former Mt. Gox CEO, said a Ledger Flex he bought at a Singapore airport contained an implant. Ledger hasn’t confirmed a link to the CryptoBilis incident.

So the honest summary is that the confirmed cases are in one channel, while the unverified reports suggest the problem might not be limited to it. Ledger’s CEO says the company is reviewing its controls for both direct and reseller sales. CryptoBreaking also reports that Ledger suspended sales in several Southeast Asian markets and Hong Kong, but we found that in only one outlet, so take it as single-sourced.

What Trezor and OneKey did

Competitors moved quickly. Trezor said it has reduced the number of resellers it works with, calling it a precaution, and says there’s no evidence its devices have been compromised. Resellers it’s dropping lose authorization on January 1, 2027, per The Block, and can sell existing inventory until then. Trezor’s own wording, quoted by Bitcoin Magazine, was that this is “a preventive step, taken out of an abundance of caution.”

OneKey says it has seen no customer fund losses, revoked CryptoBilis’s authorization, and is offering free replacements for devices bought through that reseller between March 1 and October 13, 2026.

Worth remembering: Trezor had its own bad month. Bitcoin Magazine notes that in September about 81,000 customers’ details leaked after a third-party fulfillment partner was breached. That was a data leak, not a tampered device, but it shows how much of the risk in this industry sits outside the wallet itself.

Why this attack works, and why it’s hard to see

Most hardware wallet advice assumes the device is honest. You keep the seed phrase off the internet, you confirm addresses on the device screen, you avoid phishing links. All good. But none of that helps if the thing in your hand is quietly watching the screen where the words appear.

That’s what makes a supply-chain attack so effective. The victim does everything right after unboxing. They write the phrase down on paper, they store it somewhere safe. The theft happens in the first few minutes, before any of those habits kick in. The funds may sit untouched for days or weeks afterward, which makes it harder to connect the loss to the device. The reported timeline for this incident fits that pattern: Chainalysis traced the scammer’s fund movements to September 22 and a consolidation on October 9, according to CoinTurk’s summary, while the mass drains became visible in early October.

There’s a second reason it’s hard to catch. Ledger’s description says the implant doesn’t interfere with transactions or signatures. A tampered device would look and behave normally. It would pass a casual check.

A scenario: the “good deal” on a sealed box

Imagine you’ve decided to move a chunk of your holdings off an exchange. You’re in a market where official shipping is slow or expensive, so you buy a Ledger from a local reseller at a decent discount. The box looks sealed. You set it up that evening, write the 24 words on the card, and move your funds in the next day. Everything works.

Three weeks later you’re reading about a supply-chain attack and wondering about your own device. What would you check? You can’t tell by looking at the box. You can’t tell by how the wallet behaves. The only answer is to assume the worst and migrate to a new device with a fresh phrase, which is exactly what Ledger tells people to do. That’s an annoying afternoon. It beats the alternative.

What to do if you own a Ledger or any hardware wallet

Ledger’s guidance, as reported by CoinDesk and Gizmodo, is narrow and specific. The rest of this section is common-sense hygiene rather than anything Ledger has formally recommended.

If you bought from CryptoBilis: Ledger says don’t initialize an unused device. If you already set one up, move your assets to a new device with a newly generated recovery phrase.
If you want to inspect a device: Ledger has published an inspection guide. Its CTO warned that opening a device can damage it, so back up your recovery phrase first.
Buy direct. The simplest defense is to order from the manufacturer’s own store rather than a third-party seller, marketplace or airport kiosk. A discount isn’t worth it.
Treat any pre-written phrase or odd packaging as a hard stop. A legitimate device generates its phrase on setup. If anything arrives pre-initialized, don’t use it.
Don’t panic-migrate on rumor. If your device came directly from Ledger or another official source, nothing reported so far says it’s affected. Moving funds in a hurry creates its own mistakes.

For the fundamentals of how recovery phrases work and why they matter this much, our guide to seed phrase security covers the rules, and our comparison of software and hardware wallets lays out the trade-offs.

What we don’t know yet

How many devices were tampered with, and how many users set one up.
Who installed the implants, and where in the supply chain it happened. Ledger says that’s under investigation. Theories floating around online are guesses.
Which models are affected. The reporting we reviewed doesn’t name them for the CryptoBilis units, and the only named model in the wider reports is the Ledger Flex, from an unverified claim.
The real loss total, and how much can be recovered. The Tether freeze is a start, but it covers a fraction of the reported amount.
Whether the unverified European and Singapore reports are linked to the same operation.

We’ll update this piece if Ledger publishes a fuller post-mortem.

FAQ

Did Ledger get hacked?

Ledger says no. It calls this a physical supply-chain attack on devices sold through a reseller and says its own software, systems and services weren’t breached. Ledger’s statement is the main source for this, and an independent forensic review hasn’t been published.

How did the implant steal recovery phrases?

Per Ledger’s Donjon team, an implant inside the case read the recovery phrase from the screen during setup and sent it over LTE through an eSIM. It didn’t alter the Secure Element, the operating system, or transaction signing.

How much was stolen?

Third-party estimates range from about $86 million to about $103 million across hundreds of wallets. Ledger says it hasn’t fully verified any of them.

Are Trezor wallets affected?

Trezor says it has seen no evidence of compromised devices. It has reduced its reseller network as a precaution. OneKey says it has no reports of customer fund losses and has cut ties with CryptoBilis.

Should I stop using hardware wallets?

Not on this evidence. The failure here was a tampered device obtained through a third-party channel, not a flaw in the idea of keeping keys offline. Buying direct from the manufacturer addresses the specific route attackers used.

Key takeaways

Ledger confirmed on October 13, 2026 that devices sold by reseller CryptoBilis contained an implant that captured and transmitted 24-word recovery phrases.
Reported losses range from about $86 million to $103 million across 300-plus wallets, but Ledger hasn’t verified any total.
Ledger says its Secure Element, operating system and own systems weren’t compromised. The tampering happened before the devices reached buyers.
Reports from Germany and Singapore are unverified and not confirmed as linked.
If you bought a hardware wallet from an unofficial seller, check Ledger’s guidance and consider moving funds to a fresh device with a new phrase. Buy direct from the manufacturer from now on.

This article is educational and is not financial advice. Details of fast-moving security incidents can change after publication. Do your own research (DYOR) before making any decision, and never share a recovery phrase with anyone.

Want more on keeping your holdings safe? Read our guide to spotting a crypto scam before it costs you and our breakdown of the Bitget breach, and subscribe so you catch the next security update.

Sources & references

hardware wallet, Ledger, supply chain attack

Blockchain News

Sidechains vs. Layer-2s: What’s Actually the Difference?

October 26, 2026