Over $100 Million Lost in Ledger Wallets Due to Supply-Chain Attack via CryptoBilis Reseller

This attack underscores vulnerabilities in the cryptocurrency hardware market, particularly through third-party distribution channels.

• On October 9, 2026, a coordinated attack compromised Ledger wallets sold via Southeast Asian reseller CryptoBilis, draining between $93 million and $102 million from over 300 wallets.
• Unauthorized hardware implants captured users' 24-word seed phrases during device setup, allowing attackers to reconstruct and empty wallets.
• Ledger confirmed that the breach was limited to third-party channels, emphasizing the integrity of its direct sales and manufacturing processes.

• Prior to this incident, Ledger devices were considered highly secure, with no confirmed breaches in direct sales.
• Criminal actors inserted custom implants into genuine devices, which were then sold through third-party resellers, exploiting the growing reliance on self-custody solutions.
• The attack reflects a broader trend of supply-chain vulnerabilities in the cryptocurrency sector, where the value stored in hardware wallets continues to rise.

The October 2026 incident represents a sophisticated supply-chain attack that exploited vulnerabilities in the distribution of Ledger hardware wallets. Criminal groups acquired legitimate Ledger devices, modified them with unauthorized hardware implants, and then reintroduced these compromised devices into the market through third-party resellers like CryptoBilis. This method allowed attackers to capture users' 24-word seed phrases during the initial setup of the wallets, a critical piece of information that enables access to the associated cryptocurrency.

Once the wallets were compromised, attackers strategically delayed draining the funds until users had deposited significant amounts of cryptocurrency. This tactic maximized the yield from each compromised wallet, resulting in a total estimated loss of between $93 million and $102 million across 324 wallets. The incident highlights the risks associated with purchasing hardware wallets from third-party resellers, as opposed to directly from manufacturers, which can ensure the integrity of the devices.

Ledger's response included issuing advisories to users who purchased from CryptoBilis, urging them to avoid setting up their wallets or to generate new seed phrases on fresh devices. Meanwhile, CryptoBilis temporarily suspended operations, and Tether froze approximately $10 million in USDT linked to the compromised wallets. On-chain analysis has been ongoing, with investigators tracking the movement of the drained funds across multiple blockchains, revealing partial laundering attempts.

This incident is not an isolated event but part of a troubling trend in the cryptocurrency space, where the value stored in hardware wallets is increasing, making them attractive targets for organized crime. As self-custody solutions gain popularity, the need for robust security measures in the supply chain becomes paramount. The attack on Ledger serves as a wake-up call for both consumers and manufacturers to prioritize security and transparency in the distribution of cryptocurrency hardware.

• Cryptocurrency holders: Users who purchased Ledger wallets from CryptoBilis are at immediate risk of losing their funds.
• Third-party resellers: Companies like CryptoBilis may face reputational damage and operational disruptions.
• Investors in cryptocurrency: The incident could lead to increased scrutiny and regulatory measures affecting the broader market.

• Increased security measures: Watch for Ledger and other manufacturers to enhance security protocols in their supply chains to prevent future breaches.
• Regulatory responses: Monitor potential regulatory actions aimed at third-party resellers in the cryptocurrency hardware market.
• Market reactions: Observe how this incident affects consumer confidence in hardware wallets and the overall cryptocurrency market.