Ledger is investigating a major cryptocurrency theft linked to devices purchased from CryptoBilis, a reseller operating in Southeast Asia.
CryptoBilis is listed by Ledger as an official reseller in several Southeast Asian markets, which is why the incident cannot simply be dismissed as a case of users buying hardware from an unknown third-party seller.
Early on-chain estimates put the losses above $86 million. A newer analysis by Bitquery estimates that $102M was drained from 335 wallets across six blockchains, although Ledger has not confirmed either the total loss or the number of affected users.
The critical distinction is that there is currently no evidence of a Ledger-wide hack affecting all devices, firmware or infrastructure. The company has linked the reports to users who bought devices from CryptoBilis and is still investigating how their keys may have been compromised.
For Ledger owners, that means the response depends heavily on where the device came from and whether it has already been initialized.
What Happened to Ledger Users?
Ledger's investigation has now revealed how an unauthorized hardware implant could steal a user's recovery phrase without compromising the device's Secure Element.
According to Ledger Donjon's October 13 findings, the implant sits inside the device enclosure and monitors the data shown on the screen. When the 24-word recovery phrase appears during setup, the implant's microcontroller decodes the words and transmits them over LTE using a provisioned eSIM.
According to Ledger's analysis of the examined implant, the unauthorized component does not modify the Secure Element or Ledger OS, nor does it alter transactions or signatures.
This also highlights a limitation of Ledger's Genuine Check: a device may contain an authentic Secure Element and pass verification while still carrying unauthorized hardware components.
The attack exposed a different kind of hardware wallet risk: attackers did not need to break Ledger's cryptographic protections. By modifying a genuine device before it reached the customer, they could capture the recovery phrase during an otherwise normal setup process.
Ledger Implant Reports Reach Germany
Concerns about physically modified Ledger devices have now extended beyond the CryptoBilis investigation in Southeast Asia.
On October 13, German electronics retailer MediaMarkt Saturn suspended sales of Ledger devices following the discovery of an unauthorized hardware implant in a device purchased by a customer in Germany. No loss of funds was reported in that case.
Security researcher Johannes separately reported finding suspicious hardware modifications in two Ledger devices purchased from different MediaMarkt locations.
However, these reports do not establish that Ledger devices sold across Europe have been systematically compromised. The connection between the German findings and the CryptoBilis-related thefts has not been confirmed, and the point at which the devices were modified remains unknown.
Ledger says it is reviewing reports of implants found in other signers and locations, but has not verified any fund drain linked to a signer purchased outside CryptoBilis.
Ledger has also asked authorized resellers and distributors across Southeast Asia and Hong Kong to suspend sales while the investigation continues. The company inspected devices from retail stores and warehouses, including in Germany, and reported finding no compromised units among those examined.
Ledger tightened its reseller requirements. Authorized sellers must now keep devices off display shelves, store inventory in back rooms until purchase, and promptly report suspicious products. The company also reiterated that returned devices must never be resold, even if their packaging appears unopened. Ledger says it is developing additional device-level protections against similar attacks.
What the On-Chain Data Shows
Bitquery's investigation, updated on October 16, estimates that approximately $102 million was stolen from 335 wallets across six blockchains, up from its previous count of 324. Ledger has not independently confirmed the total losses or the number of affected customers. The estimated losses include:
- approximately $79.3 million on TRON;
- $16.8 million in Bitcoin;
- $3.7 million on Ethereum;
- $1.45 million on BNB Chain;
- about $580,000 on Polygon;
- roughly $250,000 on Solana.
Bitquery found that 25 TRON wallets signed the same approval within three seconds. Eight minutes earlier, another 30 wallets had reportedly handed control to the attacker's key. On Bitcoin, 111 wallets were emptied in a single block using similar transaction behavior.
The firm also identified roughly two weeks of smaller test transactions before the main drain.
Was Ledger Actually Hacked?
Ledger has confirmed an unauthorized hardware implant inside at least one signer connected to the CryptoBilis incident and has now described how the implant operates. According to Ledger Donjon, the implant reads information displayed on the device screen, detects the 24-word recovery phrase during setup, decodes it and transmits it over LTE using a provisioned eSIM. Ledger has not confirmed how many devices contained the implant or whether this mechanism explains every wallet drain associated with the incident.
Ledger says all confirmed fund losses tied to the incident disclosed on October 9 involve signers sold through CryptoBilis. The company says it has not verified a drain linked to a signer purchased elsewhere.
A compromised recovery phrase would allow an attacker to recreate the wallet elsewhere and move the assets without physically possessing the owner's Ledger.
Albert Quehenberger, CEO of AQ Forensics and ChangeNOW Ambassador, has previously pointed to the same broader weakness in crypto custody: the cryptography itself is often not where real-world compromises happen. Phishing, exposed recovery seeds, fake wallet software, compromised devices and social engineering can all bypass otherwise strong technical protections.
Is CryptoBilis Legit?
CryptoBilis was listed as an authorized Ledger reseller in Southeast Asia, meaning customers had reason to believe they were buying devices through a legitimate sales channel. However, authorized reseller status does not guarantee that every device reaches the buyer without tampering.
Following the October 2026 theft, Ledger linked confirmed fund losses to devices sold through CryptoBilis and launched an investigation into the distribution process.
CryptoBilis also changed ownership earlier in 2026, with its former founders stating that they handed over operational control in March. There is no verified evidence that the ownership change was connected to the attack.
The key distinction is that CryptoBilis's former authorized status does not establish whether its current operations or affected devices can be trusted.
How Much of the Stolen Crypto Has Been Frozen?
Investigators have also made progress tracing the stolen funds.
According to Bitquery, Tether has frozen approximately $10 million in USDT linked to the theft. The frozen tokens were held across 20 addresses.
The attacker has meanwhile been actively moving other assets beyond the reach of stablecoin issuers. Large amounts of stolen USDT were swapped into ETH and USDD, while thousands of ETH were routed through Tornado Cash and later through Zcash and cross-chain services.
The laundering activity continued through October 16. According to Bitquery, approximately 7,700 ETH had passed through Tornado Cash since the theft. The attacker also moved $2.38 million in USDC before Circle could freeze it. As of October 16, Bitquery could still trace approximately $81 million on-chain, although traceability does not mean those assets have been recovered or remain available for freezing.
MistTrack has documented some of these movements in real time:
Who Should Take Action Right Now?
The clearest high-risk group is users who purchased a Ledger from CryptoBilis.
Here is the practical breakdown.
| Situation | What to do now |
|---|---|
| Bought from CryptoBilis and have not initialized the signer | Do not set it up. Contact Ledger Support. |
| Bought from CryptoBilis and already initialized it | Transfer assets promptly to a new trusted signer using a completely new recovery phrase. Do not reuse or restore the old phrase. |
| Bought from another retailer but suspect physical tampering | Do not initialize or continue using the signer. Contact Ledger Support and preserve the device for investigation. |
| Bought from another retailer and have no signs of tampering | Ledger has not verified a drain linked to a signer purchased outside CryptoBilis. Continue following official updates. |
| Wallet has already been drained | Contact Ledger Support and local law enforcement. Preserve the signer and do not open or send it anywhere before coordinating with them. |
A sealed box or a successful Genuine Check should not be treated as absolute proof that a device has never been physically modified. The CryptoBilis case shows why the distribution channel matters alongside the wallet's built-in security features.
Do All Ledger Owners Need to Move Their Crypto?
Based on the information available now, no.
There is currently no evidence that every Ledger owner, or even Ledger owners generally, need to migrate their assets.
Moving funds unnecessarily during a breaking security incident creates risks of its own: fake support accounts, phishing sites, malicious wallet software and fraudulent “security checks” tend to appear quickly when users are scared and looking for instructions.
If your Ledger was not purchased from CryptoBilis and there are no other signs that your recovery phrase or device has been compromised, the current evidence does not indicate a Ledger-wide emergency.
For a broader guide to cold-wallet risks and safe storage practices, see ChangeNOW's guide on whether cold wallets are safe.
Watch for the Second Attack: Phishing
Messages claiming that users must “verify” a Ledger, migrate immediately, connect to a security portal or enter a recovery phrase should be treated with extreme suspicion.
Quehenberger puts the most important rule simply:
“Any request for a seed phrase, private key or wallet backup should be an immediate stop signal.”
Ledger likewise repeatedly warns that it will never ask users to provide their 24-word Secret Recovery Phrase.
Do not enter a recovery phrase into a website sent through an email, direct message, advertisement or supposed support conversation.
One user reported receiving a scam letter sent by mail from France and impersonating Ledger, adding that others had reported similar letters alongside scam calls and phishing emails.
If action is required, navigate to Ledger's official channels independently rather than following unsolicited links.
What If Your Ledger Wallet Was Already Drained?
If funds are already missing, speed matters.
Preserve:
- affected wallet addresses;
- transaction hashes;
- transaction history;
- timestamps;
- screenshots;
- purchase and device information;
- communications or suspicious messages connected to the incident.
Report the incident to law enforcement and contact relevant platforms or qualified blockchain investigators where appropriate.
This matters because blockchain transactions remain traceable after a theft, but the opportunity to intervene may shrink once assets reach mixers, cross-chain services or other destinations.
As Quehenberger explained:
“The transaction history may stay, but the opportunity to act can disappear very fast.”
What We Still Don't Know about Ledger Drain
Several major questions remain open:
- How many Ledger devices were physically modified, and at what point in the supply chain did the tampering occur?
- Does the confirmed implant mechanism explain all of the wallets drained in the CryptoBilis incident?
- Are the hardware modifications reported in Germany connected to the CryptoBilis thefts?
- How many individual customers were affected, and what is the final confirmed financial impact?
- Does the affected purchase period extend beyond Ledger's initial 90-day warning?
- How much of the stolen cryptocurrency can ultimately be frozen or recovered?
- Were all affected CryptoBilis signers modified using the same implant design?
While investigators have identified a working hardware implant mechanism, the full scale of the incident and the relationship between the reported cases remain unresolved.
Fake Ledger Sites Are Appearing in Search
The current Ledger investigation is unfolding alongside a separate phishing risk.
Security researcher CyberScrilla reported a fake Ledger website and app appearing at the top of Google Search, apparently designed to steal users' seed phrases. The researcher explicitly noted that there is no confirmed link between the phishing site and the reported CryptoBilis-related thefts.
Ledger responded publicly to the report, saying it had forwarded the malicious domain to its team and warning that impersonation scams remain common.
The company reiterated a basic rule:
“Ledger will never call, DM, or ask for your 24-word recovery phrase.”
Fake search results and lookalike domains can be difficult to spot, especially when branding, HTTPS and page design appear legitimate. For more on how these attacks work, see our guide to Punycode phishing and lookalike domains.
Users searching for urgent instructions may encounter fake support pages, malicious ads or impersonation accounts precisely when they are most likely to act quickly.
So even if the phishing campaign turns out to be completely unrelated to the CryptoBilis case, the practical takeaway is the same: do not enter a recovery phrase into a website, form or support chat, and do not assume that a top Google result is legitimate.
ChangeNOW continues to support its industry partners, including Ledger, in efforts to identify and respond to illicit crypto activity. If funds linked to the CryptoBilis theft are detected moving through our services, we will cooperate with relevant parties in line with our compliance procedures and applicable requirements.
