Ledger has confirmed an unauthorized hardware implant in at least one device tied to unexpected cryptocurrency drains. The confirmed cases point to hardware sold by CryptoBilis, a Southeast Asian reseller operating in Indonesia, Malaysia, and the Philippines. This is physical tampering in the supply chain, not a remote breach of Ledger own systems.

What happened

Users reported missing funds from devices bought through CryptoBilis. Ledger said on 10 October 2026 that one impacted user device contained an unauthorized implant, and that it was contacting affected users. On 11 October it said every unexpected-drain report it had was linked to CryptoBilis and that the number of impacted devices looked limited. CryptoBilis paused hardware-wallet sales. Ledger says its internal systems and direct sales channels were not affected.

Independent teardowns describe the implant behind the screen, on the display SPI bus, with an LTE radio, antenna, eSIM, and a microcontroller. That placement can watch the seed phrase as it is shown and the buttons as they are pressed, then send the data out over cellular. The genuine secure element can remain intact. Ledger documentation says Genuine Check authenticates that secure element and can miss a spying implant when the element is untouched. Researchers also reported the original battery replaced with a smaller cell to make room for the extra board.

On-chain estimates of the 9 October drains vary. Bitquery has put the figure near $93 million across hundreds of wallets. Ledger has not confirmed a loss total. Do not treat any third-party dollar figure as the vendor number.

Who is affected

• Buyers of Ledger hardware from CryptoBilis, including devices that still looked factory sealed
• Not, on Ledger account, buyers who purchased directly from Ledger
• Anyone who entered a seed phrase on a suspect device

A shrink wrap is not proof the board is clean. The implant sits outside the chip that Genuine Check validates.

What to do now

If a wallet came from CryptoBilis, stop using it, move funds to a new wallet bought from Ledger directly, and treat the old seed as burned. Generating a new seed on the suspect device does not help. The implant can read the new phrase off the screen.

For any hardware wallet purchase, buy from the manufacturer or a channel you can trace. Run Genuine Check, then still inspect the device: a smaller battery, an extra antenna cable, or a board behind the screen is a stop-use condition. Do not type an existing seed into a replacement until you trust the hardware.

Source: BleepingComputer: Ledger confirms spy chip implant behind wallet crypto thefts.

Also on the blog

• GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
• CVE-2026-102255 SonicWall SMA1000 SSRF Under Probe
• Bricksforge CVE-2026-85097: unauthenticated file upload exploited
• Anthropic cuts live internet from all internal Claude evaluations

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.