Supply chain attack on Ledger devices leads to $72–93 million in losses

This incident highlights vulnerabilities in the supply chain of hardware wallets, raising concerns about the security of digital assets.

• Unauthorized implants: Attackers inserted cellular hardware implants into Ledger wallets sold by CryptoBilis, allowing them to capture users' recovery phrases.
• Significant losses: An estimated $72 million to $93 million was drained from hundreds of wallets across multiple blockchains.
• Immediate response: Ledger halted sales through CryptoBilis and confirmed the presence of at least one implant on affected devices.

• Supply chain vulnerabilities: Hardware wallet security relies on the integrity of the supply chain, where authorized resellers can introduce risks during handling.
• CryptoBilis ownership change: The reseller underwent an ownership change earlier in 2026, which may have created opportunities for tampering.
• Impact on users: Affected users are advised not to initialize devices purchased in the last 90 days, as their recovery phrases may have been compromised.

On October 9, 2026, users in Southeast Asia began reporting drained wallets purchased from CryptoBilis, an authorized Ledger reseller. Investigations by on-chain analysts, including Specter and Bitquery, revealed that funds totaling between $72 million and $93 million were funneled through various blockchains, including Bitcoin, Ethereum, and Solana. The majority of these transactions occurred within a 48-hour window, indicating a coordinated effort to exploit the compromised devices.

Ledger's investigation confirmed the presence of unauthorized hardware implants capable of capturing and transmitting recovery phrases via cellular networks. These implants were cleverly concealed behind device screens, allowing them to bypass Ledger's standard security checks. The company quickly directed CryptoBilis to halt all sales and shipments and advised affected customers to refrain from using devices purchased in the previous three months.

The incident underscores the critical importance of supply chain integrity in the hardware wallet market. Authorized resellers like CryptoBilis introduce additional handling points where devices can be tampered with, creating vulnerabilities that can be exploited by malicious actors. Ledger emphasized that the breach was isolated to the reseller channel, with no evidence of compromise to its own manufacturing or direct sales.

In response to the attack, Ledger has begun developing enhanced anti-tampering measures and is collaborating with authorities and security groups to trace the stolen funds. Tether, a major player in the crypto space, has frozen approximately $10 million in USDT linked to the compromised wallets, further illustrating the ripple effects of the breach across the ecosystem.

As investigations continue, independent researchers have documented multiple generations of implants in devices from the region, raising concerns about the potential for similar attacks in other markets. While Ledger has not verified reports of broader geographic spread, the incident serves as a stark reminder of the risks associated with third-party resellers and the importance of purchasing directly from manufacturers.

• Affected users: Individuals who purchased Ledger wallets from CryptoBilis are at immediate risk of losing their funds.
• CryptoBilis: The reseller faces reputational damage and operational disruptions due to halted sales and investigations.
• Investors and traders: Those holding assets on affected blockchains may experience market volatility as news of the breach spreads.

• Investigation outcomes: The results of ongoing investigations will determine the extent of the breach and any further vulnerabilities in the supply chain.
• Market reactions: Monitor how the crypto market responds to this incident, particularly regarding user trust in hardware wallets and third-party resellers.
• Regulatory responses: Watch for potential regulatory changes aimed at enhancing security standards for hardware wallets and their supply chains.