Ledger has confirmed a physical supply-chain tamper, not a remote break-in of its own systems. At least one hardware wallet sold by Southeast Asian reseller CryptoBilis contained an unauthorized implant. Users who bought devices from that reseller reported drained funds.
What happened
Ledger said on 9 October 2026 that it was investigating missing funds tied to devices bought from CryptoBilis, which sells in Indonesia, Malaysia, and the Philippines. On 10 October, Ledger Support said one impacted user's device contained an unauthorized hardware implant. On 11 October the company said every confirmed case in that incident involves CryptoBilis-sold devices, that the number of affected devices looks limited, and that its own systems and direct-sales channel were not hit. CryptoBilis paused hardware-wallet sales.
Reporting on the implant says it can read what the screen shows during setup, capture the 24-word recovery phrase, and send it out over a built-in cellular link. It does not alter the secure element or the signing flow, which is why a normal device check can miss it. Ledger has not confirmed a loss total. On-chain researchers have estimated roughly 86 million to 93 million dollars across more than 300 wallets. Those figures are third-party estimates, not a Ledger number. Ledger also said it is looking at similar reports involving other dealers.
Who is affected
- Anyone who bought a Ledger signer from CryptoBilis, especially in the last 90 days
- Users who already set the device up and still hold funds on that seed
- Buyers of hardware wallets from unofficial resellers, until Ledger finishes checking other dealers
What to do now
If you bought a Ledger from CryptoBilis in the last 90 days and have not set it up, do not set it up. If you already did, move assets to a new signer with a new seed bought from Ledger or a trusted channel. Do not type the old recovery phrase into the suspect device again. Ledger's direct store and its own systems are not the source of the confirmed cases. Treat any hardware wallet from an unofficial reseller as untrusted until you can verify the supply chain.
Source: The Hacker News, 12 October 2026.
Also on the blog
- GitLab CVE-2026-97229: CVSS 10.0 unauthenticated RCE
- SonicWall CVE-2026-102255 SMA1000 SSRF probed
- Danfoss AK-SM controllers heated French fridges to 50C
- Midnight Mimosa: budget Android phones ship with uninstallable malware
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.