The Ledger Supply-Chain Attack

On October 9, 2026, on-chain investigator Specter published a bombshell: roughly $86 million in crypto had been drained from Ledger users’ wallets. The theft addresses — about 98 of them — showed inflows from hundreds of victim wallets across Bitcoin, Ethereum, and Tron. Another researcher estimated losses above $72 million and climbing; some analyses put the figure as high as ~$93 million across 311 wallets and five networks.

Reports had been surfacing on X and Reddit from Ledger owners whose wallets were suddenly emptied. A day later, Ledger confirmed the worst part of the story: this wasn’t a software bug or a breached server. One of the affected users’ devices contained an unauthorized hardware implant. Someone had physically tampered with the wallets before they reached buyers.

A hardware wallet keeps your private keys locked inside the device. But your 24-word recovery phrase is the master key: anyone who has it can restore your wallet on another device and take everything — no physical access to your Ledger required.

The alleged attack went like this:

1. Genuine Ledger devices were intercepted before reaching buyers.
2. The attacker opened the casing and installed a tiny electronic implant.
3. During setup, when the user generated or displayed their recovery phrase, the implant recorded it and transmitted it out (reports describe an eSIM component).
4. The attacker restored the wallet elsewhere and drained the funds.
5. The device kept working perfectly normally — victims had no idea anything was wrong.

This is called a supply-chain attack: the compromise happens between the factory and your doorstep. Your keys were never “hacked” in the technical sense — they were copied at birth.

“The device continued to function normally, without the user noticing anything.”

All roads point to one distributor: CryptoBilis, a reseller listed as an authorized Ledger partner in Indonesia, Malaysia, and the Philippines. Ledger asked CryptoBilis to halt all device sales and shipments while the investigation continues, and the reseller confirmed it had ceased sales of its entire hardware-wallet inventory.

This is the critical detail for understanding the blast radius: so far, the evidence points to one distributor’s supply chain, not a flaw in Ledger devices themselves. A problem limited to one reseller has very different implications than a vulnerability affecting every Ledger ever sold — and so far, there is no evidence of the latter.

Ledger has not confirmed how many customers are affected, nor independently confirmed the loss totals reported by on-chain investigators.

• Ledger is actively investigating and contacting affected users, and asked anyone with information to reach its bounty program.
• If you bought a Ledger from CryptoBilis in the last 90 days and haven’t set it up: don’t.
• If you already set one up: Ledger advises moving your assets to a new device initialized with a brand-new recovery phrase.
• Ledger continues to warn that it will never ask for your recovery phrase — not on a website, not in an app, not in a support chat.

The investigation is ongoing, and the full picture — exact victim count, total losses, and how the implants were introduced — is still developing.

If you bought from any third-party reseller — not just CryptoBilis — treat the device as suspect until you can verify its authenticity. And if you bought from CryptoBilis in the last 90 days, follow Ledger’s guidance above: don’t initialize it, or migrate to a fresh device with a new seed if you already did.

1. Buy hardware wallets only from the manufacturer. This is the single most important rule. No Amazon marketplace sellers, no eBay, no “authorized” third parties if you can avoid them. The few dollars you save are not worth the risk.
2. Never share your recovery phrase. Not on a website, not in an app, not with “support,” not in a DM. Ledger will never ask for it. Anyone who does is a scammer, full stop.
3. Verify your device on arrival. Inspect the packaging and the device — tamper-evident seals exist for a reason. Ledger’s Genuine Check is worth running, but reporting on this incident says it does not detect the implant, because it only verifies the secure element, which the implant leaves untouched.
4. Consider an extra passphrase. Ledger supports an additional passphrase on top of the 24-word seed. An attacker with only the seed phrase can’t touch a passphrase-protected wallet.
5. Watch for the “too good to be true” reseller. Discount hardware wallets from unfamiliar sellers are a classic attack vector — now proven at scale.

Bitcoiners say “not your keys, not your coins.” This attack adds a corollary: not your supply chain, not your keys either. Self-custody only works if the device generating your keys is trustworthy from the moment it leaves the factory — and the only party you can hold to that standard is the manufacturer itself.

A hardware wallet is the strongest link in most people’s security — until the moment it isn’t. Buy direct. Guard your seed. Verify everything.

Figures cited (loss estimates, address counts) are as reported by on-chain investigators and news outlets in October 2026 and have not all been independently confirmed by Ledger. This story is still developing.

Ledger confirmed how the implant works. The unauthorized component found in devices sold through CryptoBilis reads the wallet’s screen, decodes the 24-word recovery phrase when it appears, and sends the words out over LTE mobile networks using a built-in eSIM. Ledger says the implant does not alter the chip storing the keys or the device’s operating system — which is exactly why compromised wallets kept working normally.

Trezor is cutting its reseller network. In an October 13 announcement, Trezor said it will reduce the number of authorized resellers so it can vet the remaining partners more closely. Affected resellers stop receiving new stock immediately and lose authorization on January 1, 2027, though they may sell existing inventory through the holiday season. Partners that remain will operate under a stricter legal framework covering how devices are sourced, stored, and handled. Trezor stressed the move is preventive — “there is not a single piece of evidence that Trezor devices have been compromised” — and it had already removed CryptoBilis from its own reseller list on October 12 as a precaution.

OneKey is following suit. OneKey revoked CryptoBilis’ reseller authorization, is reviewing its wider network, and is offering free replacements for OneKey devices bought through CryptoBilis between March 1 and October 13, regardless of model or activation status.

Reported October 13, 2026 by CoinDesk, The Block, news.bitcoin.com, and others; Trezor’s announcement was posted on X at 13:32 UTC. This story is still developing.