On October 9, 2026, users in Southeast Asia reported drained wallets after buying Ledger hardware wallets from the reseller CryptoBilis. Within three days, Ledger confirmed that one affected device contained an unauthorized hardware implant. Meanwhile, investigators put the estimated losses between $72 million and $102 million. This article lays out what the Ledger CryptoBilis incident involves and which questions remain open.
72 hour update on reseller CryptoBilis incident 🔽 As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users. To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected. We take the CryptoBilis situation seriously and are actively investigating. We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets. We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products. Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines. Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes. We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts. This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users. We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem. If you have relevant information, contact security@ledger.com. For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger. If you have concerns that your device was impacted by the CryptoBilis incident, please contact Ledger Support through the official site: https://t.co/JUcWwJO9iF. Ledger Support is available 24/7 to answer your questions and concerns. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase.
— Ledger (@Ledger) October 11, 2026
What happened on October 9
Ledger said on October 9 that it was investigating reports of lost funds from customers who bought devices through CryptoBilis. CoinDesk reported that the pseudonymous investigator Specter first flagged the drains, with suspected thefts across Bitcoin, Ethereum, and Tron addresses. Ledger asked CryptoBilis to pause all sales and shipments while the investigation continued. The company did not confirm a loss figure or a cause in that first statement.
Ledger also told recent buyers not to activate unused devices. Customers who had already set up a CryptoBilis device received a separate instruction. They had to move their assets to a new Ledger device with a freshly generated recovery phrase. According to Crypto Briefing, the affected devices came from purchases made within roughly the previous three months.
CryptoBilis operates in Indonesia, Malaysia, and the Philippines, according to the same report. Ledger has described the reseller as the common link in every confirmed case. Furthermore, the company has not tied any loss to a device bought directly from Ledger.
What Ledger has confirmed
On October 10, Ledger Support stated that one impacted user’s device contained an unauthorized hardware implant. Ledger said it had not established whether the implant caused the reported losses. The company also said it had not independently confirmed that the implant performed the function researchers described.
Ledger published a 72-hour update on X on October 11. The update said all confirmed cases tied to the October 9 draining incident involve devices sold through CryptoBilis. In addition, Ledger said its own systems and direct sales channels remain unaffected. The company also said CryptoBilis has confirmed it stopped all hardware wallet sales.
Ledger described the number of affected devices as limited, although it has not published a count. It said it is working with authorities and reaching out to affected users. Additionally, the company thanked the volunteer security group SEAL 911 for its support. Ledger told users to file complaints with local law enforcement and to contact Ledger Support through official channels.
What researchers found inside the device
Former Mt. Gox CEO Mark Karpelès reported on October 9 that he found an extra electronic component behind the display of a Ledger Nano X from CryptoBilis, according to Crypto.news. Tibane Labs later published a technical analysis. It described a microcontroller, cellular communication hardware, and connections to the screen’s internal data lines.
Help Net Security quoted Karpelès on how the circuit board would work. He said the implant watches what the screen shows, notes the recovery phrase as it appears, and transmits it to the attacker. He listed an antenna, an LTE chip, and an e-SIM card on the board. BleepingComputer cited researchers who identified an ST STM32G431KBU6 microcontroller and two implant variants. One variant used a modified battery, and the other sat beneath the OLED display.
BleepingComputer also reported that Ledger’s authentication mechanism cannot detect an added implant while the original secure element keeps working. These technical details come from outside researchers. Ledger has confirmed only that one device held an unauthorized implant.
Ledger Flex sold at Singapore Airport confirmed to contain a spy implant! @BenYorke found suspicious marks on his @Ledger and sent it to me rather than using it, that was probably the best decision here. https://t.co/aP7gDEbvtq https://t.co/3VumJyBFD2 https://t.co/2NtXWIbJYs
— Mark Karpelès (@MagicalTux) October 13, 2026
How large the losses are
No single loss figure exists yet, and each number depends on the investigator’s method. Specter’s early tracing, as reported by CoinDesk, pointed to more than $86 million. On-chain analysts at Bitquery first reported about $92.9 million drained from 311 wallets across five blockchains. Bitquery’s page, updated through October 12, now lists $102.0 million taken from 324 wallets across six chains.
Bitquery’s latest breakdown shows Tron carried most of the damage. It counted 140 Tron wallets and $79.3 million. Bitcoin followed with 122 wallets and $16.8 million, and Ethereum had 33 wallets and $3.7 million. BNB Chain, Polygon, and Solana made up the remainder. Bitquery values the funds at October 9 prices.
Bitquery’s timeline shows a compressed attack window. Thirty Tron wallets fell at 04:59 UTC on October 9. All six chains were hit within 47 minutes. Bitquery wrote that one thief appears to have held the keys to every victim wallet. However, it noted that the exact source of the key compromise remains partly unconfirmed.
Where the stolen funds went
Bitquery traced the stolen funds through swap services including THORChain, Relay.link, and NEAR Intents. The attacker then used Tornado Cash and Zcash for mixing. Bitquery said roughly $20 million remained untraced or in active mixing at its last measurement.
PeckShield separately traced $3.89 million to Binance deposits, according to Crypto Briefing. Tether reportedly froze about $10 million in USDT tied to the thefts.
Update on Ledger devices at MediaMarkt Saturn 🔽 As of Oct. 13th, MediaMarkt Saturn has stopped, with Ledger’s alignment, the sale of Ledger devices in their stores and online while the investigation continues, following the report of an implant from one customer in Germany. No loss of funds were reported. We have no indication that Ledger’s infrastructure, systems or services were compromised. Ledger Support is reviewing user reports, and Ledger’s cybersecurity experts, the Donjon will be examining the devices we receive: https://t.co/QzukOZdEzq. If you have questions about a device you bought, contact Ledger Support at https://t.co/QzukOZdEzq. Ledger will never call you, message you directly or ask for your 24-word recovery phrase. Many claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger and MediaMarkt Saturn channels for updates. We will share more as the investigation continues.
— Ledger (@Ledger) October 13, 2026
Guidance for affected users
Ledger’s instructions for CryptoBilis buyers stay consistent across its statements. Buyers should not initialize unused devices. Users who already set up a device should move funds to a new seed on a device bought from Ledger. Anyone concerned about a device can contact Ledger Support through the official site.
Ledger also warned about scammers who exploit incidents like this one. The company said it will never call a user, send a direct message, or ask for a 24-word recovery phrase. Furthermore, Ledger told authorized resellers to source products only through authorized channels and never to restock returned products. It advised users against buying from unauthorized resellers. Ledger also asked researchers and other vendors to share relevant information at security@ledger.com.
*Disclaimer: News content provided by Genfinity is intended solely for informational purposes. While we strive to deliver accurate and up-to-date information, we do not offer financial or legal advice of any kind. Readers are encouraged to conduct their own research and consult with qualified professionals before making any financial or legal decisions. Genfinity disclaims any responsibility for actions taken based on the information presented in our articles. Our commitment is to share knowledge, foster discussion, and contribute to a better understanding of the topics covered in our articles. We advise our readers to exercise caution and diligence when seeking information or making decisions based on the content we provide.
