Ledger Wallet Hack: $86 Million Stolen Through Implanted Devices From a Reseller

The Ledger wallet hack that hit the news on October 9, 2026 is not a hack of Ledger's chip. The company is investigating losses by customers in Southeast Asia who bought devices from the reseller CryptoBilis; on-chain analysts estimate the damage at $72-86 million, while Ledger has confirmed neither the figure nor the cause. A day earlier Mark Karpeles, the former head of Mt.Gox, published research by Tibane Labs: two Nano X units contained a hardware implant that reads the seed words off the display bus and sends them out over a cellular network. The secure element was never touched; the secret leaked on its way to the screen. Here is what is known, how the implant works, and what to do if your device came through an intermediary.

Key takeaways

• On October 9, 2026 Ledger confirmed an investigation into losses by buyers of devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, and asked it to stop sales.
• Analyst tanuki42 linked more than $72 million to the thefts; analyst Specter put the figure above $86 million across Bitcoin, Ethereum and TRON. Ledger has not confirmed the numbers, and the estimates may overlap.
• Tibane Labs found an implant under the screen of two Nano X units bought in Japan: it reads the 24 recovery words during setup and transmits them through its own cellular module with a SIM card and antenna.
• Ledger says its own infrastructure is not compromised and that it has no complaints about devices bought directly from the company.
• A device from CryptoBilis bought in the last 90 days should not be set up; an already activated one should be replaced with a new device and a new seed phrase.

Key terms

• Hardware wallet is a physical device that stores private keys offline and signs transactions without exposing the keys to a computer or phone.
• Secure element is the certified chip inside a Ledger device that stores the keys and signs transactions.
• Seed phrase is the list of 24 recovery words shown once during setup; anyone who has it controls the funds.
• Passphrase is an optional 25th word that creates a separate set of accounts not reachable with the 24 words alone.
• Hardware implant is an extra circuit board hidden inside a device that intercepts or transmits data.
• Genuine check is the verification in the Ledger Live app that confirms the secure element is authentic.

What is known as of October 12

Ledger said its infrastructure, systems and services are not compromised and that there are no complaints about devices bought directly from the company. Its advice is targeted: buyers who got a device from CryptoBilis in the last 90 days and have not set it up should not start; those who already activated a wallet should consider moving assets to a new device with a new seed phrase. Changpeng Zhao, the co-founder of Binance, described the case as a supply chain attack, an attack in which a product is tampered with between the manufacturer and the buyer, through a single seller. One caveat: the loss estimates come from anonymous researchers and may overlap by address.

How the implant behind the Ledger wallet hack works

The Tibane Labs research covers two Nano X units. Under the screen sits an additional board that intercepts signals on the bus between the secure element and the display. During initial setup the device shows the user 24 recovery words; the implant reads them from the display signals, recognizes them and transmits them to the attacker through a built-in cellular module.

• The chip is intact. The secure element works normally. The implant captures information on its way to the screen, so the genuine check does not detect the tampering.
• It is not modified firmware. The code on the device is authentic, and firmware updates neither fix nor reveal the problem: the intervention is hardware, not software.
• Several generations. From an early build with visible wires to a compact board marked v1.1 and manufactured industrially.
• Where the units came from. One Nano X was bought on Yahoo! Auctions in Japan, the other on Amazon Japan, with the parcel shipped from Malaysia.
• No proven link to CryptoBilis. Tibane Labs states that the devices it examined are not connected to the Ledger investigation. The former co-founders of CryptoBilis told the researchers they handed the business to new owners in March 2026 and have had no access since.

One theory discussed by industry media: implanted devices were sold over months, seed phrases were collected, and when the warning from Japan became public the stolen keys were used all at once. That would explain why dozens of wallets were emptied on the same day.

Why it matters wherever Ledger does not ship

In markets without official delivery, including Russia, devices arrive through intermediaries, marketplaces and resellers. The CryptoBilis case shows that an authorized reseller label is not a guarantee, and the longer the chain from manufacturer to courier, the more links where a box can be opened and the contents modified.

A hardware wallet protects keys from malware and phishing, but not from a device that arrives with someone else's eyes already inside. We covered another compromised-device case, a firmware flaw that weakened key generation, in our piece on hardware wallet security. There the problem was how keys were created; here it is how they leak. The passphrase is a partial barrier: the 24 words leak, but the 25th word is typed separately and never shown on screen during setup. A more advanced implant could capture input too, so it lowers the risk rather than removing it.

How to check your device

1. Recall where and when the wallet was bought. A direct purchase from the manufacturer or an old purchase before 2026 is low risk; an intermediary, a marketplace or a purchase in recent months is a reason to act.
2. Run the genuine check in Ledger Live. It is mandatory but not sufficient: it confirms the secure element is authentic, and the implant does not touch the chip.
3. Inspect the case: signs of opening, uneven seams, extra components under the screen. The researchers ask victims to send photos of the board, because the implant is visible once the device is opened.
4. Never use a device that comes with a pre-filled recovery sheet or arrives "pre-configured". The words must appear on your screen during the first setup, done by you.
5. If in doubt, generate a new seed phrase on a device from a transparent supply chain and move the assets there. Treat the old addresses as compromised.

What a Ledger owner should do now

A loud incident always brings a second wave of scams: expect "check your Ledger for an implant" and "update the firmware via this link" messages. No manufacturer and no researcher asks for a seed phrase; how such letters look is shown in our piece on the hardware wallet data breach at SafePal and Trezor and in our guide to crypto phishing scams. Beyond that, the Ledger wallet hack leaves owners a short list.

1. Device bought from CryptoBilis or any unknown intermediary in the last 90 days and not set up: do not set it up.
2. Device already activated and not bought directly: move assets to a new device with a new seed phrase generated on your own screen.
3. Enable the passphrase and store it separately from the 24 words.
4. Buy hardware wallets only through a chain you can trace back to the manufacturer, and do not trust "sealed" boxes from private sellers: a seal proves nothing.
5. Follow official updates on the investigation and ignore emails, calls and messages about a "device check".