# Tampered Ledger wallets from an Asian reseller leak seed phrases; on-chain estimate puts losses near $102M

- Severity: Critical · Status: Partly contained (live)
- Chains: Tron, Ethereum, BNB Chain, Polygon, Solana, Bitcoin · Method: Supply-chain stealers
- Started: Oct 9, 2026 · Last update: Oct 16, 2026 · Reported stolen: $102M · Victims: 324
- Who/what: Ledger hardware wallets (Nano X, Flex, Stax) bought from reseller CryptoBilis and some other third-party sellers

Ledger hardware wallets sold by CryptoBilis, a Southeast Asian reseller, had a hidden implant added after manufacture that read the 24-word recovery phrase during setup and sent it out over an LTE eSIM. Coordinated drains began on 9 October 2026 across TRON, Ethereum, BNB Chain, Polygon, Solana and Bitcoin. Bitquery's on-chain estimate is about $102M from 324 wallets, and investigator Specter put it above $86M. Ledger has not confirmed a figure. Anyone who set up a Ledger bought from a third-party seller in the affected markets should move funds to a new seed made on a device bought direct.

## Am I affected?
You are at risk if you set up a Ledger bought from CryptoBilis (Indonesia, Malaysia, the Philippines), or from another third-party shop, marketplace, auction or airport retailer in Southeast Asia or Europe, or second-hand. Ledger's Genuine Check cannot detect this implant, so passing it is not proof the device is clean.

## What to do now
- If the device is not set up yet, do not set it up. Contact Ledger only through support.ledger.com.
- If you already set it up, assume the thief knows your recovery phrase. Get a new device directly from the maker, create a brand-new seed on it, and move every asset (all chains, tokens, NFTs and staked positions) to it.
- Never type the old seed into the new device or any app.

## How to avoid this
- Buy hardware wallets only from the maker's own store or a listed authorized reseller. Avoid marketplaces, auctions and returned stock.
- Never use a device that arrives with a recovery phrase already printed or filled in.
- For large holdings, use a multisig across devices from different vendors and sources, so one leaked seed is not enough.

## Indicators (block these, never visit them)
- Address: TWGHw7ZsDdXaP6Jw3vJgJ35FHKUvetBf3E
- Address: TEqZsE39aNXRnuTwrXJ9ooWMc87puuZxpK
- Address: 0x381825deb972b3d0a031a9ce86902ac8b22df8f2

## Sources
- Ledger confirms spy chip implant behind wallet crypto thefts (BleepingComputer, 2026-10-12): https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/
- Ledger asks sellers across Asia to halt sales after supply-chain attack (BleepingComputer, 2026-10-14): https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/
- Ledger confirms unauthorized hardware implant, says losses may exceed $86M (Cointelegraph, 2026-10-11): https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m
- Factory Sealed (Rekt News, 2026-10-16): https://rekt.news/factory-sealed

Full record: https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets · JSON: https://drains.watch/i/ledger-cryptobilis-tampered-hardware-wallets.json

Rules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support.