Supply Chain Attack · Urgent

CryptoBilis Tampered Ledger Devices: Full Investigation

Ledger has confirmed that devices sold through Southeast Asian reseller CryptoBilis contained hidden hardware implants. These implants captured users‘ 24-word recovery phrases from the device screen during setup and transmitted them over LTE cellular networks using an embedded eSIM. Estimated losses exceed $86 million across 300+ wallets.

Incident date: October 9, 2026 (fund drains reported) Live · Washington, DC: --:--:-- Supply Chain Attack / Hardware Implant / Hardware Wallet Tampering

Don’t Panic: This Is Isolated to One Reseller

If you bought your Ledger from Ledger.com, an official Ledger store, or an authorized retailer other than CryptoBilis, your device is not affected. You can continue using it with confidence.

Ledger has confirmed that all currently confirmed theft cases involve devices sold through CryptoBilis, a single reseller operating in Southeast Asia . Ledger‘s own infrastructure, systems, and direct sales channels have not been compromised .

Hardware wallets remain the most secure way to store crypto. The CryptoBilis incident is a supply-chain issue with one distributor — not a flaw in hardware wallet technology itself.
Your private keys never leave the Secure Element chip. Even in this incident, the chip was not breached — the attack exploited the display during setup [citation:13].
Millions of Ledger users worldwide use devices bought through official channels without any issue. This is not a reason to abandon hardware wallets — it‘s a reminder to buy from trusted sources.

URGENT: Do Not Use Devices from CryptoBilis

If you purchased a Ledger device from CryptoBilis and have not set it up: DO NOT INITIALIZE THE DEVICE. Contact Ledger Support immediately.

If you have already set up a device from CryptoBilis: Transfer your assets immediately to a new wallet with a newly generated recovery phrase, using a device purchased directly from Ledger or an authorized retailer.

Do not enter or restore any recovery phrase on a device bought from CryptoBilis.

Estimated Losses

$86M+

Up to $103M per some researchers

Affected Wallets

300+

Across BTC, ETH, Tron networks

Attack Type

Hardware

Physical implant in device casing

Ledger Systems

Safe

No software or infrastructure breach

How the Attack Works

Malicious implant installed in device casing

Implant reads screen during initial setup

Decodes 24-word recovery phrase via microcontroller

Transmits phrase via LTE using embedded eSIM

Attacker drains wallet remotely — no further access needed

What the implant DID affect

Captured recovery phrase from screen
Transmitted data over cellular network
Enabled remote wallet draining

What the implant did NOT affect

Ledger‘s Secure Element chip
Device operating system or firmware
Transaction signing process
Ledger’s own systems and infrastructure

Timeline of Events

Sep 16, 2026

Tampered devices first observed Early signal

Researchers note tampered Ledger devices appearing in the market at nearly half the normal price.

Oct 9, 2026

Fund drains reported Critical

Users in Southeast Asia report crypto assets drained from wallets linked to CryptoBilis-purchased Ledger devices. Ledger launches investigation and asks CryptoBilis to halt sales.

Oct 10, 2026

Hardware implant confirmed

Ledger confirms that at least one affected user‘s device contained an unauthorized hardware implant.

Oct 12, 2026

Attack mechanism detailed

Ledger Donjon reveals the implant captures recovery phrases from the screen and transmits them via LTE using an embedded eSIM. All confirmed losses traced to CryptoBilis devices.

Oct 14, 2026

Sales suspended across Southeast Asia & Hong Kong Ongoing

Ledger requests resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales. Trezor and OneKey terminate CryptoBilis authorization. European reports under investigation.

What You Should Do Now

Do NOT set up new devices

If you bought a Ledger from CryptoBilis and haven’t initialized it yet, do not set it up. Contact Ledger Support for guidance.

Transfer funds immediately

If you already set up a device from CryptoBilis, move all assets to a new wallet with a NEW recovery phrase. Do not reuse the old phrase.

Purchase from official sources

Buy Ledger devices directly from Ledger.com or verified authorized retailers. Never buy from third-party marketplaces or unofficial resellers.

⚠️ Phishing Warning

Scammers are exploiting this incident. Ledger will NEVER call you, DM you, or ask for your 24-word recovery phrase. If anyone contacts you claiming to be from Ledger Support and asks for your seed phrase, it is a scam.

Only trust information from ledger.com and Ledger‘s official social media channels.

Primary sources: Ledger Official, CoinDesk, Cointelegraph, The Block, BleepingComputer Page updated dynamically · Washington, DC time shown above