Ledger has confirmed that an unauthorized hardware implant was found inside a signer sold through Southeast Asian reseller CryptoBilis, establishing physical tampering as a confirmed element of an investigation into widespread wallet drains. Ledger says every confirmed loss associated with the October 9 incident so far involves devices sold through CryptoBilis, while its own systems and direct sales channels show no evidence of compromise.
In its initial official CryptoBilis investigation update, Ledger asked the reseller to halt sales while the investigation proceeded. CryptoBilis is listed in Ledger’s own authorized-reseller directory for markets including Indonesia, Malaysia and the Philippines. The security boundary therefore sits in the distribution path identified by the investigation rather than in a confirmed breach of Ledger’s core infrastructure.
Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to…
— Ledger Support (@Ledger_Support) October 10, 2026
Implant Captured Recovery Phrase From the Screen
Ledger’s Donjon security team has since provided a technical explanation of the implant. The additional hardware sat inside the device enclosure and monitored information being sent to the display. When a newly initialized signer showed its 24-word recovery phrase, the implant could decode those words and transmit them over LTE through a provisioned eSIM, giving an attacker the information required to reconstruct the wallet elsewhere.
Importantly, Ledger says the implant operated independently of its Secure Element and did not modify the device operating system or normal transaction-signing process. The attack therefore did not need to defeat the cryptographic protections around private-key signing if it could capture the recovery phrase during initialization. That distinction resembles other wallet incidents where the critical failure occurred around seed handling rather than the blockchain itself, including a mobile-wallet seed-generation flaw investigated by Coinspect and malware targeting wallet recovery material on iOS.
Ledger has advised customers who bought a CryptoBilis device within the previous 90 days not to initialize it if setup has not begun. Users who already initialized one were told to move assets to a different signer using a newly generated recovery phrase. Restoring the existing phrase onto replacement hardware would not resolve the exposure if that phrase had already been captured.
On-Chain Loss Estimates Rise Toward $93M
The financial scale remains less certain than the implant itself. Early researcher estimates exceeded $72 million and later $86 million, while a subsequent reconstruction counted approximately $93.2 million removed from 315 wallets across TRON, Bitcoin, Ethereum, BNB Chain, Polygon and Solana. Ledger has not published its own confirmed victim count or aggregate loss figure.
That distinction prevents the current on-chain estimate from being treated as a Ledger-confirmed loss. It also remains unclear where in the supply chain the unauthorized components were installed or how many modified units entered circulation. Ledger has confirmed the implant and the CryptoBilis connection for its verified cases, but the full scope and insertion point of the tampering remain under investigation. Reports involving devices obtained elsewhere have surfaced, although Ledger has not verified a drain tied to another retailer.
The incident highlights a different failure mode from software-wallet compromises such as the malicious Trust Wallet browser-extension update, where code intercepted recovery phrases after reaching users through a software distribution channel. In the CryptoBilis case, genuine Ledger security components could continue functioning as designed while unauthorized hardware positioned around them exposed the wallet’s root recovery secret.
Ledger has not publicly announced a compensation program for affected customers. For now, the strongest confirmed findings are narrower than the headline loss estimates: at least one affected CryptoBilis-sold signer contained a recovery-phrase-stealing hardware implant, all loss cases confirmed by Ledger remain tied to that reseller, and the investigation into how broadly the tampering spread is continuing.