In Brief:
- Ledger reports a security incident involving hardware wallets, with an unauthorized implant capturing recovery phrases during setup.
- Over 102 million USD has been tracked as lost, affecting wallets across Bitcoin, Ethereum, and TRON.
- All confirmed cases trace back to devices sold through CryptoBilis, an authorized reseller in Southeast Asia.
Incident Overview
Ledger’s security research team, Ledger Donjon, detailed a breach on October 13, after the incident began on October 9. An unauthorized implant within certain hardware wallets captures users’ 24-word recovery phrases displayed during setup, transmitting them via LTE using a hidden eSIM. This allows attackers to recreate wallets elsewhere and drain them.
Scope of the Losses
Blockchain investigator Specter has assessed that losses exceed 102 million USD, with onchain data reflecting funds moving across multiple chains. Bitquery’s analysis indicated that 324 wallets were compromised, with more than 80% of these having received funds since June 2026, suggesting an extended vulnerability period beyond initial estimates.
Connection to CryptoBilis
All verified incidents are linked to devices purchased from CryptoBilis, an authorized reseller in Malaysia, Indonesia, and the Philippines. Ledger noted that devices sold through its direct channels remained secure. As a precaution, Ledger halted sales through CryptoBilis, which has ceased all hardware wallet sales and closed physical stores pending an internal review.
Tampered Devices in Europe
Reports of similar tampering have surfaced in Europe. Security researcher Johannes posted images of a Ledger Nano X with additional wiring not found in authentic units. Another user found a tampered Ledger Stax device featuring unauthorized components. Ledger has not confirmed a connection to CryptoBilis for these devices but is investigating further reports.
User Guidance
Ledger advised users who purchased devices from CryptoBilis not to initialize them and to contact support resources. Those currently using such wallets should transfer assets to secure devices bought directly from Ledger. Users suspecting tampering should preserve the device for investigation and file reports with local authorities.
Industry Response
Wallet manufacturers have reacted swiftly. Trezor has eliminated CryptoBilis from its authorized reseller list, while OneKey is providing free replacements for affected devices. Ledger CTO Charles Guillemet stated that the company will enhance its reseller and security measures in the wake of this incident.
Implications for Web3 Gaming
This breach serves as a warning for web3 gamers who rely on hardware wallets to safeguard tokens and NFTs. It underscores the importance of sourcing devices directly from manufacturers and being wary of inauthentic or compromised products. With over 102 million USD in potential losses, the ramifications are significant as asset security remains paramount.
