Ledger CryptoBilis tampered wallets seed theft

What happened

On 9 October 2026 Ledger said it was investigating reports that customers in Southeast Asia had lost funds from hardware wallets bought through CryptoBilis (also spelled CryptoBillis). CryptoBilis is listed as an authorised Ledger reseller for Indonesia, Malaysia and the Philippines.

As a precaution, Ledger asked the reseller to pause all sales and shipments of Ledger devices. The company's support account told buyers from that reseller in the previous 90 days not to start setup if they had not already. Anyone who had already set up such a device was told to consider moving assets to a new Ledger signer with a newly generated recovery seed.

On 10 October 2026 Ledger confirmed that one of the impacted users' devices contained an "unauthorized hardware implant." Cointelegraph later quoted Ledger saying the incident appeared isolated to that single reseller and market, and that "Ledger's infrastructure, systems and services were not compromised." The investigation was still ongoing.

This is not a software bug in Ledger's secure element or firmware that would earn a CVE. It is a physical supply-chain and reseller-channel problem: devices that look like genuine Ledgers, sold through a named reseller, with at least one confirmed to contain extra hardware that should not be there.

How the tampered devices worked

Ledger's public statements confirm the implant itself. They do not publish a full teardown of every victim device. Reporting and community teardowns describe the suspected mechanism at a high level as follows.

A small extra circuit board is placed inside the case, often described as sitting under or near the screen. When the buyer initialises the wallet, the device displays the 24-word recovery phrase on its screen. That phrase is the master backup for the wallet. Anyone who records it can recreate the keys on another device and spend the funds without touching the original Ledger.

The implant is alleged to eavesdrop on what the screen shows during that setup, capture the recovery words, and send them out over a cellular connection. Social media photos and videos shared during the incident show a board and SIM-style connectivity. The Verge summarised that reporting on 10 October. Ledger has not published its own component-level analysis in the statements cited here.

Importantly, this path does not require breaking the secure element that holds the keys. If the words were shown on a compromised screen, they must be treated as leaked even if the device still passes a genuine-device check. Ledger's own hardware-integrity help page notes that its Genuine Check proves the secure element is Ledger's, but "cannot detect unauthorized physical modifications to the hardware—such as spying implants—if the original Secure Element remains intact."

ThreatWire does not describe how to build or install such a module.

Who is affected

The confirmed risk window Ledger published is buyers who purchased from CryptoBilis in the 90 days before the 9 October warning. Those who have not initialised the device should leave it unused. Those who have should treat the recovery phrase as exposed and move funds to a new device with a new seed, using official Ledger instructions.

Southeast Asia is the geographic focus in Ledger's statement. There is no public indication that wallets bought directly from Ledger.com are in scope. Ledger told Cointelegraph the case appeared limited to the one reseller and its market.

People who bought Ledger-branded devices from informal marketplaces, second-hand sellers, or any channel that could have opened the package face the same practical risk pattern: physical tampering before first use. The CryptoBilis case is the one Ledger has named.

On-chain investigators have published loss estimates tied to drained wallets reported by users. Those figures are discussed below; they are not a Ledger victim count.

What is confirmed

These points come from Ledger or from established news coverage of Ledger's statements:

• Ledger is investigating fund losses among CryptoBilis buyers in Southeast Asia.
• Ledger asked CryptoBilis to pause sales and shipments; the reseller later ceased hardware-wallet sales pending the investigation, according to Ledger's follow-up.
• Ledger confirmed an unauthorized hardware implant in one impacted user's device.
• Ledger says its infrastructure, systems and services were not compromised.
• Ledger's guidance for recent CryptoBilis buyers: do not set up an unused device; if already set up, consider moving assets to a new signer with a new seed.
• Ledger asked people with information to contact its bounty program.

On-chain investigators independently traced large theft clusters after users reported drains. Specter estimated more than $86 million across Bitcoin, Ethereum and Tron. Researcher tanuki42 earlier put related addresses above $72 million. Analytics firm Bitquery later counted about $92.9 million from 311 wallets across five chains. The Block, Decrypt and Cointelegraph all stress that Ledger has not confirmed these totals.

There is no CVE for this incident.

What is not confirmed

Several claims circulating in teasers and social posts are not established as fact:

• A single official loss figure of "$80 million." Public estimates range from the low seventies of millions to the low nineties, depending on which addresses and chains are included. Ledger has not endorsed any of them.
• That every drained wallet, or hundreds of wallets, each contained the same implant. Ledger has confirmed one implant. How many devices were tampered with, and whether every on-chain loss shares the same cause, is still under investigation.
• A complete Ledger-authored technical description of the implant's modem, wiring or firmware. Screen-capture-plus-cellular details come from reporting and community teardowns, not from a finished Ledger Donjon paper cited here.
• Compromise of Ledger's factory, cloud services or app. Ledger denies that.
• Arrests or a named threat group. None of the primary reporting cited here attributes the theft to a specific organisation.

Rival vendor blogs and aggregator posts that restate the same points without new primary evidence are not used as sources for this article.

What to do

Follow Ledger's published advice if you bought from CryptoBilis:

• Do not initialise a device you have not yet set up.
• If you already set it up, move assets to a new Ledger signer with a newly generated recovery seed, using official support channels.
• Contact Ledger support only through support.ledger.com. Ledger says it will never ask you for your 24-word recovery phrase.

For everyone else:

• Prefer buying directly from Ledger or from resellers you can verify on Ledger's official list at the time of purchase.
• Never use a device that arrives with a recovery phrase already written down, printed, or "pre-configured." Generate the seed on the device yourself and write it down privately.
• Run Ledger's Genuine Check during onboarding, but understand its limit: it does not prove the case is free of spy hardware if the secure element is still genuine.
• If you bought second-hand or from a marketplace with unclear custody of the package, assume the seed may be known and move funds to a new seed on a trusted device.
• Watch only official Ledger channels for updates. Ignore unsolicited messages that ask for your seed or offer "recovery" services.

If you believe you are a victim, preserve the device, contact Ledger support and, where appropriate, local law enforcement. On-chain response groups such as SEAL 911 have been named in investigator posts as a place affected users can seek help; that is not a substitute for Ledger's official process.

Sources: The Block and Decrypt (9 October 2026), The Verge (10 October 2026), Cointelegraph (11 October 2026), Bitquery's CryptoBilis drain analysis, and Ledger's hardware-integrity support article. Loss figures are investigator estimates unless Ledger confirms them.