Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M
Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers
Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.
Why this severity: $102M reported stolen, 324 victims, only partly contained.
- Started
- Oct 9, 2026
- Method
- Supply-chain stealers
- Reported stolen
- $102M
- Victims
- 324
Indicators · never visit or send to these
- TWGHw7ZsDdXaP6Jw3vJgJ35FHKUvetBf3E
- TEqZsE39aNXRnuTwrXJ9ooWMc87puuZxpK
- 0x381825deb972b3d0a031a9ce86902ac8b22df8f2
What to do now
- If the device is not set up yet, do not set it up. Contact Ledger only through support.ledger.com.
- If you already set it up, assume the thief knows your recovery phrase. Get a new device directly from the maker, create a brand-new seed on it, and move every asset (all chains, tokens, NFTs and staked positions) to it.
- Never type the old seed into the new device or any app.
Stay safe
Am I affected?
You are at risk if you set up a Ledger bought from CryptoBilis (Indonesia, Malaysia, the Philippines), or from another third-party shop, marketplace, auction or airport retailer in Southeast Asia or Europe, or second-hand. Ledger's Genuine Check cannot detect this implant, so passing it is not proof the device is clean.
What to do now
- If the device is not set up yet, do not set it up. Contact Ledger only through support.ledger.com.
- If you already set it up, assume the thief knows your recovery phrase. Get a new device directly from the maker, create a brand-new seed on it, and move every asset (all chains, tokens, NFTs and staked positions) to it.
- Never type the old seed into the new device or any app.
How to avoid this
- Buy hardware wallets only from the maker's own store or a listed authorized reseller. Avoid marketplaces, auctions and returned stock.
- Never use a device that arrives with a recovery phrase already printed or filled in.
- For large holdings, use a multisig across devices from different vendors and sources, so one leaked seed is not enough.
Timeline 7
Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.
SourceLedger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.
SourceLedger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.
SourceInvestigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.
SourceLedger confirmed that at least one affected device contained an unauthorized hardware implant.
SourceLedger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.
SourceCoordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.
Source
News & write-ups ›4
- Ledger confirms spy chip implant behind wallet crypto theftsBleepingComputer · Oct 12, 2026
- Ledger asks sellers across Asia to halt sales after supply-chain attackBleepingComputer · Oct 14, 2026
- Ledger confirms unauthorized hardware implant, says losses may exceed $86MCointelegraph · Oct 11, 2026
- Factory SealedRekt News · Oct 16, 2026
How this method works
A popular code package or app update is hijacked to steal wallet keys or swap addresses, hitting everyone who installs it. Read about supply-chain stealers →
Follow new drains and updates in your feed reader or Telegram RSS bot.