Blockchain analytics firm Bitquery estimates that $102 million has been drained from 324 cryptocurrency wallets linked to Ledger hardware devices sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, and the Philippines. Ledger confirmed on October 10, 2026, that at l...
"This is a complex investigation, and as CEO, I am leading it with my Executive team. We are dedicating time and resources to explore every aspect to protect Ledger users and find the malicious actors." — Pascal Gauthier, CEO, Ledger
Blockchain analytics firm Bitquery estimates that $102 million has been drained from 324 cryptocurrency wallets linked to Ledger hardware devices sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, and the Philippines. Ledger confirmed on October 10, 2026, that at least one affected device contained an unauthorized hardware implant — a small circuit board with LTE cellular capability hidden behind the device screen, designed to capture and transmit users' 24-word recovery phrases during wallet setup.
The incident represents the largest confirmed hardware supply-chain attack in cryptocurrency history. It exposes a structural gap in Ledger's security model: the company's Genuine Check verification authenticates only the Secure Element chip, leaving physical modifications to the display data bus undetectable. CryptoBilis changed hands in early 2026, with full ownership passing to an individual registered in China's Heilongjiang province by August 3. No evidence has publicly linked the ownership transfer to the breach, but investigators have noted the timing.
On October 11, a European buyer reported discovering a similar hardware implant in a Ledger Nano X purchased from a separate European reseller, raising questions about whether the compromised distribution network extends beyond Southeast Asia.
September 25, 2026: On-chain data shows addresses associated with the theft receiving initial funding, according to Bitquery.
September 26 – October 7: Twenty-one small test transactions executed on TRON and another 20 on Ethereum, establishing withdrawal infrastructure.
October 9: Users across Southeast Asia begin reporting unexplained fund disappearances from hardware wallets. Hundreds of reports surface within hours. Ledger instructs CryptoBilis to halt all sales and shipments of Ledger devices.
October 10: Ledger confirms that at least one affected device contains an unauthorized hardware implant. The company issues guidance urging CryptoBilis customers who purchased devices in the preceding three months not to initialize them, and those who already have to move funds to a freshly generated seed on a new device.
October 11: A European buyer discloses discovery of a hardware implant in a Ledger Nano X purchased from a European reseller, expanding the geographic scope of concern.
October 12: Bitquery updates its loss estimate from $86 million to $93.2 million across 315 wallets on six blockchains. Ledger CTO Charles Guillemet issues operational guidance and states the company is reviewing its reseller controls and anti-tamper protections.
October 13: Bitquery raises its estimate to $102 million drained from 324 wallets. CoinDesk reports the implant used an LTE module with an embedded eSIM and a microcontroller capable of recognizing Ledger's proprietary font on the 128-by-64-pixel display.
The attack is not a software exploit. It is a physical modification to hardware devices somewhere in the supply chain between Ledger's factory and the end user.
The implant itself consists of a small circuit board fitted with three components: an LTE cellular modem, a data eSIM, and a microcontroller. It was placed behind the device's display screen. The device's battery was trimmed slightly to accommodate the additional board — a modification invisible without physically opening the casing.
How it works: The implant does not touch or modify the Secure Element (SE), the tamper-resistant chip where private keys are generated and stored. Instead, it taps the data bus between the SE and the display. When the device enters the setup phase and the 24-word recovery phrase is shown on screen, the microcontroller — programmed to recognize Ledger's display font — reads the words from the screen output and transmits them over the LTE network to an external endpoint.
Why it bypasses Genuine Check: Ledger's verification system, called Genuine Check, authenticates the Secure Element by challenging it to produce a cryptographic proof that it is an unmodified Ledger chip. The implant never interacts with the SE. It is a passive eavesdropper on the display bus. The SE has no mechanism to detect the presence of additional hardware on the data path between itself and the screen. Ledger has confirmed that Genuine Check cannot detect this class of modification.
This is an intelligence-grade attack vector. The approach mirrors techniques documented in government signals intelligence programs, where hardware interception devices are inserted into consumer electronics during transit or at point of sale.
Bitquery's on-chain investigation, updated October 13, provides the following breakdown of drained funds:
| Blockchain | Estimated Loss | Wallets Affected | |------------|---------------|------------------| | TRON | $79.3M | ~180 | | Bitcoin | $16.8M | ~60 | | Ethereum | ~$3.5M | ~40 | | BNB Chain | ~$1.2M | ~20 | | Polygon | ~$0.7M | ~15 | | Solana | ~$0.5M | ~9 | | Total | $102.0M | 324 |
TRON's dominance in the stolen fund breakdown — 77.7% of total losses — reflects its widespread adoption as a stablecoin transfer rail in Southeast Asia, where USDT-TRC20 is commonly used for everyday transactions and savings.
A notable pattern: Bitquery found that 25 TRON wallets recorded approvals for the same address within a three-second window, followed by withdrawals totaling $29 million. This simultaneity suggests automated execution from a single operator with pre-staged access to all compromised seed phrases.
The attacker appears to have operated methodically. Test transactions began 14 days before the main draining event, with small amounts moved across TRON and Ethereum to validate withdrawal paths. The main drain executed on October 9 in a concentrated burst.
CryptoBilis is based in Kuala Lumpur and was listed on Ledger's official reseller directory for Indonesia, Malaysia, and the Philippines. Company records show:
No evidence currently links the ownership transfer to the supply-chain compromise. Investigators have flagged the correlation in timing — full ownership transferred approximately two months before the first test transactions appeared on-chain — but causation has not been established.
CryptoBilis also served as an authorized reseller for Trezor, CoolWallet, Tangem, OneKey, Ellipal, and SafePal. Whether devices from those manufacturers were also modified remains unknown as of publication.
The incident exposes a design limitation in Ledger's anti-tampering architecture. Genuine Check is built to verify firmware and Secure Element integrity. It was not designed to detect physical modifications to other components of the device.
The threat model Genuine Check addresses is firmware replacement or SE substitution — scenarios where an attacker swaps the core cryptographic chip for a malicious one. The CryptoBilis implant operated entirely outside this perimeter. It added hardware; it did not replace it.
This matters for the broader hardware wallet industry. Every hardware wallet manufacturer that relies solely on chip-level attestation — without physical tamper detection (e.g., tamper-evident seals, mesh sensors, or enclosure integrity checks) — is theoretically vulnerable to the same attack class.
Tangem, a competitor, noted in a post-incident analysis that its wallet cards use a single-chip architecture with no display, eliminating the display-bus attack surface. CoolWallet similarly pointed to its sealed card-form factor. These are architectural differences, not patches.
On October 11, a buyer in Europe publicly disclosed discovering a hardware implant in a Ledger Nano X purchased from a European reseller. The device had passed Genuine Check. The buyer discovered the implant after disassembling the wallet following news of the Southeast Asian incidents.
Ledger has not confirmed whether this European case is connected to the CryptoBilis supply chain or represents an independent compromise. The company stated it is investigating.
If confirmed, this would indicate the attack methodology has spread beyond a single reseller network. The European case is particularly significant because it suggests either cross-contamination in Ledger's distribution pipeline or independent replication of the implant technique by separate actors.
The hardware wallet market is valued at approximately $770 million in 2026, growing at a CAGR of 23.8%, according to Market Research Future. Ledger holds an estimated 28-32% market share, having shipped over 8 million devices since 2014. Trezor holds approximately 14-18%, with over 2 million units shipped.
The market's growth is structurally tied to several regulatory drivers:
A $102 million loss from a supply-chain attack on the market leader has direct implications for the industry's value proposition: hardware wallets exist specifically to eliminate the counterparty risk of exchange custody. When the supply chain itself becomes the attack vector, the security model requires re-examination.
Ledger has taken the following actions:
Ledger has emphasized that its own systems, firmware, Secure Element, and direct sales channels were not compromised. The company has not published its own loss estimate, stating through CTO Charles Guillemet that "some statements and numbers circulating online have not been verified."
Ledger has not disclosed how many resellers it maintains globally, or whether it has initiated audits of other authorized distributors.
The CryptoBilis incident is the first confirmed large-scale hardware supply-chain attack on a major cryptocurrency wallet manufacturer. At $102 million in estimated losses from 324 wallets, it exceeds the economic impact of most smart contract exploits recorded in 2026.
The attack did not require breaking cryptography, exploiting software vulnerabilities, or compromising Ledger's corporate infrastructure. It required physical access to devices between factory and customer, a circuit board smaller than a postage stamp, and a cellular data plan. The simplicity of the method relative to the scale of losses underscores a persistent blind spot in the hardware wallet security model.
For the hardware wallet industry — a $770 million market built on the premise of eliminating counterparty risk — the CryptoBilis case forces a structural question: if the supply chain is the counterparty, what verifies the supply chain? Chip attestation alone is demonstrably insufficient. The answer likely involves some combination of tamper-evident hardware design, reseller auditing, and user-verifiable physical integrity checks. Until those measures are standard, the security model has a gap between the factory floor and the user's hands.