On October 9, on-chain researchers spotted a coordinated drain of hundreds of wallets across Bitcoin, Ethereum-based networks and Tron. Galaxy Research counted about $91 million across 477 addresses — roughly $64.5 million of it USDT on Tron, $17.7 million in BTC (about 213 BTC) and $8.8 million on Ethereum and related chains. Bitquery's updated count on October 11 was about $93.2 million from 315 wallets; it also found that 25 Tron wallets signed the same token approval within three seconds, letting about $29 million in USDT leave at once, and that small test transactions had been running for about two weeks before the main theft. The two estimates use different address sets, so treat the range, not a single number, as the honest figure.
The same day Ledger said it was investigating reports of missing funds from devices bought through CryptoBilis. On October 10 Ledger Support confirmed that "one of the impacted users' devices contained an unauthorized hardware implant." On October 11 it added that all confirmed cases involve devices sold through CryptoBilis, that its internal systems and direct sales channels are unaffected, that the number of affected devices appears limited, and that it is cooperating with authorities. CryptoBilis has suspended sales of all hardware wallets pending the investigation.
Photos posted on October 11 show a Ledger Stax with components that do not belong there: a Nordic nRF9151 cellular modem, a second chip and an antenna hidden in the back shell, wired over the battery. Security firm Tibane Labs describes modified devices with extra microcontrollers and cellular modems that can read the recovery words from the display while you write them down, then transmit them. The secure element itself stays untouched — which is exactly why Ledger's Genuine Check passes: by Ledger's own threat model, it verifies the chip's authenticity but "cannot detect unauthorized physical modifications" elsewhere in the device. A wallet can look genuine, pass the check and still leak your phrase the moment you create it.
Part of the stolen ETH was routed through Tornado Cash and Zcash. Bitquery estimates Tether has frozen about $10 million of the stolen USDT, and about $5.35 million in USDC could still be frozen by Circle. That is the one advantage of stablecoins in a theft: the issuer can freeze them — but only if it acts before they are swapped.
If you bought a Ledger directly from ledger.com, nothing published so far points to your device. If you bought from CryptoBilis — or from a marketplace seller, a "discount" listing or a second-hand offer you cannot verify — treat it as suspect. This matters for a big part of our readership: many of you send money home to Indonesia, Malaysia and the Philippines, where buying a wallet from a local reseller is often cheaper and faster than waiting for international shipping. This week that convenience is the risk.
One more report is circulating: a user in Europe posted photos of a Nano X bought in a large electronics store with extra wiring inside. Ledger has not authenticated that case, nothing yet links it to the Asian devices, and the user says no funds were lost. We will update this page if it is confirmed. Separately, Binance co-founder Changpeng Zhao claimed on X that the attackers had bought the reseller; that claim is unverified.
In its 72-hour update Ledger repeated that the volume of affected devices is limited, that all confirmed cases from the October 9 drain involve devices sold through CryptoBilis, and that its systems and direct sales channels are unaffected. It is reaching out to affected users, working with authorities and thanked the security group SEAL 911. New in the statement: Ledger strongly advises against buying from unauthorized resellers, has reminded its authorized resellers to source only through authorized channels and never to restock returned products, and is asking researchers with information to write to [email protected]. Support runs 24/7 at support.ledger.com. Our caveat: CryptoBilis was an authorized reseller. Until Ledger explains how the devices were tampered with, "authorized" is not enough — buy directly from the manufacturer.
Investigators at YFarmX, who have followed the money for three days, now estimate the theft at $94.5 million and say the first 25 accounts were emptied in six seconds; the thief is still moving funds. On X, user @0xJohannes_ says a Ledger he bought in-store from an official European reseller had extra cables inside, and Mark Karpelès (former Mt. Gox CEO) says the antenna carries a "Eurasian version" label; other posts mention cases in South America and implants found in still-sealed Nano X units. None of this has been confirmed by Ledger, and no losses have been reported from those devices. We treat it as a reason for caution, not as fact.
What about Tangem? Tangem (also our affiliate partner) says supply-chain implants do not apply to its cards: the chip and NFC antenna are sealed into one card with no screen, battery or wiring, the firmware is written once at the factory, and the app checks both that the card is genuine and that it was not activated before it reached you. That argument is strongest for the seedless setup, where no recovery phrase is ever displayed. If you choose Tangem's optional seed-phrase backup, the words are shown on your phone instead — so your phone's security matters. We are testing a Tangem card ourselves and will report.
1. Unused device from a reseller? Don't initialize it. Ask the seller for a refund and contact Ledger Support. 2. Already set up a device from CryptoBilis or an unverified seller? Assume the recovery phrase is exposed. Get a new device directly from the manufacturer, create a brand-new recovery phrase on it and move your funds there. Do not restore your old phrase on the new device — the attacker may have it. 3. Talk to Ledger only via ledger.com. Ledger will never call you, DM you or ask for your 24 words; stories like this attract fake "support" accounts and look-alike sites. 4. Report it to local police — Ledger is asking victims to file complaints. 5. Check any device you buy: sealed packaging, no pre-printed recovery card, and the phrase is generated on the device in front of you. Our full checklist: how to check if your hardware wallet was tampered with.
Ledger says it is reviewing controls on authorized resellers, has told distributors to buy only through authorized channels and stopped the restocking of returned products. Those are the right steps — but until it publishes how the devices were tampered with and how many, the official store is the only channel we recommend for any hardware wallet, Ledger or Trezor alike.
Official Ledger store (shop.ledger.com) → Compare hardware wallets →Ledger says all confirmed cases involve devices sold through CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, and that its own systems and direct sales channels (ledger.com) were not breached. If you bought from CryptoBilis, or from any marketplace seller you cannot verify, treat the device as suspect. If you bought directly from Ledger, nothing points to your device.
If the device is still unused, do not set it up. If you already set it up, assume the 24-word recovery phrase is exposed: get a new device directly from the manufacturer, create a brand-new recovery phrase on it and move your funds there. Do not type your old phrase into the new device, because the attacker may already have it. Contact Ledger Support through support.ledger.com only and report the case to local police.
Not fully. Ledger's own threat model says Genuine Check verifies that the secure chip is authentic, but it cannot detect unauthorized physical modifications if that chip is intact. The reported implants added extra components (including a cellular modem in a Ledger Stax) that could read the recovery words from the screen and send them out, so a device can pass Genuine Check and still be compromised.
Ledger has not published a loss figure. Independent on-chain estimates range from about $86 million to $95 million: Galaxy Research counted roughly $91 million across 477 addresses on October 9, Bitquery about $93.2 million from 315 wallets by October 11, and investigators at YFarmX put it at $94.5 million. Tether has frozen around $10 million of the stolen USDT.
Yes, if the device comes straight from the manufacturer and you create the recovery phrase yourself. This incident is a supply-chain attack: the weak point was a resold device, not Ledger's chip or software. The rule that protects you is the same for every brand: buy only from the official store, never use a device that arrives with a pre-printed recovery phrase, and never enter your phrase anywhere except on the device itself.
All hardware wallet incidents of 2026 →Join The Crypto Edge — our free weekly briefing for sober crypto investors. New subscribers get our DCA ebook. No spam, no hype.
Subscribe free →HomeCryptoInvest is independent — no sponsored rankings, real testing with our own money. If our coverage saved you time, you can buy us a coffee.
Buy me a coffee →Disclosure: Ledger and Trezor are affiliate partners of HomeCryptoInvest; we earn a commission if you buy through our links. The only Ledger link on this page goes to Ledger's official store — the channel this incident shows matters most. That relationship did not soften this report. Sources: Ledger Support statements (October 9–11), CoinDesk, CryptoSlate, Cryptoast, Galaxy Research, Bitquery, Tibane Labs. Figures are third-party estimates and may change. Not financial advice. Disclosure · Privacy