You unpack your new hardware wallet, plug it in, and the Ledger app says: device genuine. That feels like the end of the matter. In October 2026, that feeling cost buyers of one reseller in Southeast Asia a lot of money.
On 9 October, Ledger said it was investigating thefts involving devices sold through the reseller CryptoBilis. The same day, blockchain investigator Specter estimated that more than $86 million had been drained from hundreds of wallets. The devices were not fakes. They were genuine Ledgers, and they passed every test the app knows.
Inside the devices sat a radio module that read the 24 words
On 13 October, Ledger's security team Donjon described what it had found in an affected device. An extra component sat inside the case and read whatever was shown on the screen. During setup, every Ledger device displays the 24 words of the recovery phrase, the seed. As soon as the implant recognised that screen, a microcontroller decoded the words and sent them out over the mobile network, using its own eSIM.
Whoever has the 24 words has the wallet. They no longer need your device; they simply restore the wallet on their own and empty it.
According to Ledger, the implant did not change the security chip or the operating system, and it did not forge transactions. The device did everything right. It just was not alone in the case.
The genuine check only asks whether the chip comes from Ledger
Ledger's authenticity test is called the Genuine Check. It asks the security chip, the Secure Element, for cryptographic proof that it comes from Ledger. In the CryptoBilis devices, it did come from Ledger. The check could not do anything but show green.
Ledger says so itself. Its page of buying tips, published on 6 March 2026 and updated on 18 September, states that the Genuine Check "cannot detect unauthorized physical modifications to the hardware", explicitly including "spying implants", as long as the original Secure Element is intact.
Whether Ledger said this clearly enough is now an open dispute. Mark Karpelรจs, former head of the Mt. Gox exchange, accuses Ledger of a support reply in August that claimed the opposite. Ledger CEO Pascal Gauthier rejected that. The dispute does not change the principle. The green tick answers the question "Is the chip genuine?". It does not answer whether someone opened the device.
What answers that question is the route the device took to you.
The supply chain is what makes the device safe
CryptoBilis is a reseller from Malaysia that also sells in Indonesia and the Philippines. Its founders wrote on LinkedIn in mid-October that they sold the company in March 2026 and have had no access to orders or systems since. Where exactly in the chain the devices were opened is still under investigation, according to Ledger CEO Gauthier.
The consequences already reach beyond one reseller. Ledger asked sellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales. Wallet makers OneKey and Trezor removed CryptoBilis from their reseller lists. Trezor says it has no evidence of tampered Trezor devices.
In Germany too: on 13 October, MediaMarkt Saturn pulled all Ledger devices from sale, in stores and online. A customer had reported an implant. According to Ledger, no money was lost in that case, and Ledger has not said whether the device is linked to CryptoBilis. Karpelรจs also reported a tampered Ledger Flex bought at Singapore airport. Ledger has not linked that case to CryptoBilis either.
Ledger says all confirmed losses come from CryptoBilis devices and that its own direct sales are not affected. A hardware wallet is only as safe as the last hands it passed through before yours.
The loss sits with the buyers
There is no confirmed total yet. Estimates by blockchain investigators range from $86 million (Specter, 9 October) to $102 million (Bitquery). Ledger has confirmed neither a total nor a number of victims and says the figures circulating come from third parties.
Who carries the loss is clear, though. Ledger says its systems were not affected, CryptoBilis no longer sells, and the buyers no longer have their coins. At an exchange, an insurance fund sometimes steps in. With your own wallet, nobody pays. That is the same lesson as with the big crypto hacks: Robbed! (2).
Holding your own coins means carrying the risk of the reseller chain too.
What you can do with your device now
The rules come from Ledger itself, from its statements of 11 and 13 October:
- Bought from CryptoBilis, not set up yet: do not set it up, contact Ledger Support.
- Bought from CryptoBilis, already set up: move your coins promptly to a new device with a new seed. Do not enter or restore any seed on a CryptoBilis device.
- Lost money: contact Ledger Support and the police; do not send the device to anyone or open it first.
- Buying new: directly from Ledger or from a seller on Ledger's list of authorised resellers. Ledger explicitly advises against unauthorised sellers.
- Device from another source and you are unsure: Ledger has published a guide to opening the case and looking inside. The device can break in the process, so back up the seed first.
- Always: the 24 words do not belong in any website, app or form. Ledger does not call you and never asks for the seed.
That last point matters right now. On 16 October, security firm SlowMist warned of fake "firmware updates" that exploit the case and ask for exactly those words.
What is still open
Ledger has not said how many devices are affected, where they were opened, or whether the cases in Germany and Singapore belong to it. Ledger says it is reviewing its reseller controls and the devices' tamper protection. Whether the next generation of devices can detect an opened case by itself is the question that will measure that.
FAQ
Does a firmware update or a reset help? Not according to Ledger's description: the implant is a separate component next to the chip. An update changes the Ledger's software, not the extra component.
Which devices count as affected? So far only devices from CryptoBilis are confirmed. On 9 October, Ledger advised buyers from the last 90 days not to set up their devices. OneKey is replacing devices bought from CryptoBilis between 1 March and 13 October 2026.
Is another brand safer? An authenticity check that only tests the chip cannot see a component next to it, whatever the brand. What protects you from an implant is mainly a buying route on which no stranger could open the device.
Not investment advice, not a recommendation, not a forecast โ historical patterns are no guarantee.
Study the Past โ Improve your Future ๐ฅ