{
 "slug": "ledger-cryptobilis-tampered-hardware-wallets",
 "title": "Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M",
 "url": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets",
 "json": "https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "partly-contained",
 "verification": "verified",
 "chains": [
  "tron",
  "ethereum",
  "bsc",
  "polygon",
  "solana",
  "bitcoin"
 ],
 "method": "supply-chain",
 "product": "Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers",
 "tags": [
  "tron",
  "ethereum",
  "bsc",
  "polygon",
  "solana",
  "bitcoin",
  "supply-chain",
  "ledger",
  "hardware-wallet",
  "cryptobilis",
  "reseller",
  "hardware-implant",
  "seed-phrase-theft",
  "tether-freeze"
 ],
 "amountUsd": 102000000,
 "victims": 324,
 "startedAt": "2026-10-09",
 "closedAt": null,
 "updatedAt": "2026-10-16T12:00:00Z",
 "summary": "Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.",
 "timeline": [
  {
   "date": "2026-10-09",
   "title": "Coordinated drains began at 04:59 UTC with a new key added to 30 TRON wallets, then spread to Ethereum, BNB Chain, Polygon, Solana and Bitcoin within 47 minutes.",
   "sourceUrl": "https://rekt.news/factory-sealed"
  },
  {
   "date": "2026-10-09",
   "title": "Ledger opened an investigation into user reports of unexpected fund losses and asked CryptoBilis to stop selling and shipping devices.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/"
  },
  {
   "date": "2026-10-10",
   "title": "Ledger confirmed that at least one affected device contained an unauthorized hardware implant.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/"
  },
  {
   "date": "2026-10-11",
   "title": "Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron; Ledger said its own infrastructure was not compromised.",
   "sourceUrl": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m"
  },
  {
   "date": "2026-10-13",
   "title": "Ledger's Donjon team published implant details: a separate microcontroller decodes the recovery phrase and sends it over LTE without touching the Secure Element, so integrity checks do not detect it.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/"
  },
  {
   "date": "2026-10-14",
   "title": "Ledger told distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to halt sales; MediaMarkt in Europe pulled Ledger devices after user reports, and Trezor said it is cutting its reseller network.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/"
  },
  {
   "date": "2026-10-16",
   "title": "Rekt, citing Bitquery, put losses at about $102 million from 324 wallets and reported Tether had frozen about $10 million across 20 addresses.",
   "sourceUrl": "https://rekt.news/factory-sealed"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Ledger confirms spy chip implant behind wallet crypto thefts",
   "url": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/",
   "publisher": "BleepingComputer",
   "date": "2026-10-12"
  },
  {
   "kind": "news",
   "title": "Ledger asks sellers across Asia to halt sales after supply-chain attack",
   "url": "https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/",
   "publisher": "BleepingComputer",
   "date": "2026-10-14"
  },
  {
   "kind": "news",
   "title": "Ledger confirms unauthorized hardware implant, says losses may exceed $86M",
   "url": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m",
   "publisher": "Cointelegraph",
   "date": "2026-10-11"
  },
  {
   "kind": "writeup",
   "title": "Factory Sealed",
   "url": "https://rekt.news/factory-sealed",
   "publisher": "Rekt News",
   "date": "2026-10-16"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": [
   "TWGHw7ZsDdXaP6Jw3vJgJ35FHKUvetBf3E",
   "TEqZsE39aNXRnuTwrXJ9ooWMc87puuZxpK",
   "0x381825deb972b3d0a031a9ce86902ac8b22df8f2"
  ]
 },
 "brief": "## Am I affected?\nYou are at risk if you set up a Ledger bought from CryptoBilis (Indonesia, Malaysia, the Philippines), or from another third-party shop, marketplace, auction or airport retailer in Southeast Asia or Europe, or second-hand. Ledger's Genuine Check cannot detect this implant, so passing it is not proof the device is clean.\n\n## What to do now\n- If the device is not set up yet, do not set it up. Contact Ledger only through support.ledger.com.\n- If you already set it up, assume the thief knows your recovery phrase. Get a new device directly from the maker, create a brand-new seed on it, and move every asset (all chains, tokens, NFTs and staked positions) to it.\n- Never type the old seed into the new device or any app.\n\n## How to avoid this\n- Buy hardware wallets only from the maker's own store or a listed authorized reseller. Avoid marketplaces, auctions and returned stock.\n- Never use a device that arrives with a recovery phrase already printed or filled in.\n- For large holdings, use a multisig across devices from different vendors and sources, so one leaked seed is not enough.",
 "notes": null,
 "agentBrief": "# Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M\n\n- Severity: Critical · Status: Partly contained (live)\n- Chains: Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin · Method: Supply-chain stealers\n- Started: Oct 9, 2026 · Last update: Oct 16, 2026 · Reported stolen: $102M · Victims: 324\n- Who/what: Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers\n\nLedger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.\n\n## Am I affected?\nYou are at risk if you set up a Ledger bought from CryptoBilis (Indonesia, Malaysia, the Philippines), or from another third-party shop, marketplace, auction or airport retailer in Southeast Asia or Europe, or second-hand. Ledger's Genuine Check cannot detect this implant, so passing it is not proof the device is clean.\n\n## What to do now\n- If the device is not set up yet, do not set it up. Contact Ledger only through support.ledger.com.\n- If you already set it up, assume the thief knows your recovery phrase. Get a new device directly from the maker, create a brand-new seed on it, and move every asset (all chains, tokens, NFTs and staked positions) to it.\n- Never type the old seed into the new device or any app.\n\n## How to avoid this\n- Buy hardware wallets only from the maker's own store or a listed authorized reseller. Avoid marketplaces, auctions and returned stock.\n- Never use a device that arrives with a recovery phrase already printed or filled in.\n- For large holdings, use a multisig across devices from different vendors and sources, so one leaked seed is not enough.\n\n## Indicators (block these, never visit them)\n- Address: TWGHw7ZsDdXaP6Jw3vJgJ35FHKUvetBf3E\n- Address: TEqZsE39aNXRnuTwrXJ9ooWMc87puuZxpK\n- Address: 0x381825deb972b3d0a031a9ce86902ac8b22df8f2\n\n## Sources\n- Ledger confirms spy chip implant behind wallet crypto thefts (BleepingComputer, 2026-10-12): https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/\n- Ledger asks sellers across Asia to halt sales after supply-chain attack (BleepingComputer, 2026-10-14): https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/\n- Ledger confirms unauthorized hardware implant, says losses may exceed $86M (Cointelegraph, 2026-10-11): https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m\n- Factory Sealed (Rekt News, 2026-10-16): https://rekt.news/factory-sealed\n\nFull record: https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets · JSON: https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}