Ledger Links $93M Hardware Wallet Theft to Southeast Asia Reseller CryptoBilis
Ledger confirms all verified cases of the October 2026 draining incident involve devices sold by CryptoBilis, limiting direct channel exposure.
Key points
- Ledger attributes confirmed draining cases to devices sold by Southeast Asia reseller CryptoBilis.
- On-chain researchers estimate suspected losses exceed $93 million following the October 9 incident.
- An unauthorized hardware implant containing an LTE chip and e-SIM was found in one affected device.
Ledger stated on October 11, 2026, that all confirmed cases of the wallet draining incident reported on October 9 involve devices sold through the Southeast Asia reseller CryptoBilis. The Paris-based hardware wallet maker released this update on X three days after customers in the region began reporting that their digital assets had been stolen.
On-chain researchers estimate that suspected losses from the incident exceed $93 million. Ledger emphasized that its own systems and direct sales channels were not compromised during the attack. The company has not yet commented on unverified claims from an X user suggesting that Ledger devices sold in Europe through official reseller Mediamarkt may have been similarly tampered with.
Technical Details of the Implant
Ledger confirmed that one affected device contained an unauthorized hardware implant, though the company has not explained the mechanism by which the implant operates. Former Mt. Gox CEO Mark Karpelès provided the most detailed account, stating he purchased a tampered Ledger device in Malaysia. He posted photos and videos on X showing a small circuit board hidden beneath the device’s screen, replacing the standard display padding.
Karpelès described the hidden board as carrying a microcontroller, an antenna, an LTE chip, and an e-SIM card. He explained that the implant monitors the screen to record the seed phrase as it is displayed to the user, then transmits that data to an attacker. With the recovery phrase, an attacker can rebuild the wallet on any device and drain funds without interacting with the original hardware.
This method allows attackers to collect phrases quietly and execute a coordinated drain, which aligns with the wave of thefts reported on October 9. Karpelès noted that the implant is difficult to detect visually. He stated his device arrived in intact shrink wrap and passed Ledger’s Genuine Check because the internal security chip remained authentic. He said the only reliable way to identify the extra circuit board is to physically open the device.
Who Is Affected
Ledger confirmed on Sunday that it is working with relevant authorities and reaching out to impacted users. The company advised impacted users to contact Ledger Support through official channels and to file complaints with local law enforcement authorities. Ledger also urged customers who purchased their Ledger wallet from CryptoBilis to refrain from initializing the device if they have not already done so.
The scope of the incident remains tied to the CryptoBilis reseller channel for all confirmed cases. Ledger has not provided a timeline for when the investigation will conclude or how many total devices may have been compromised. The company continues to monitor unverified reports regarding other resellers, including Mediamarkt in Europe, but has not confirmed any link to those sales.
What should you do?
Users are advised to check their purchase history to determine if their device originated from the CryptoBilis reseller. Those who have not yet initialized a device from this source should wait for further instructions from Ledger. Impacted users should report the incident to local law enforcement and contact Ledger Support. Owners of initialized devices from this channel should monitor their wallets for unauthorized transactions.
What to do and how to stay safe: Ledger
- Verify the original purchase source of your hardware wallet and check if it was sold by CryptoBilis.
- If you purchased from CryptoBilis and have not initialized the device, do not set it up until Ledger provides guidance.
- Contact Ledger Support through official channels if you suspect your device was compromised or if you are an impacted user.
- File a complaint with local law enforcement authorities if you have experienced unauthorized draining of your digital assets.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Did Ledger confirm that devices sold through Mediamarkt were compromised?
No, Ledger has not commented on unverified claims that devices sold via Mediamarkt in Europe were tampered with.
How much money was lost in the October 9 incident?
On-chain researchers put suspected losses at more than $93 million.
How can users detect the hardware implant?
Karpelès stated that the only reliable way to find the extra circuit board is to open the device, as it passes standard security checks.
