Ledger: a chip hidden in resold devices drained 315 wallets
Ledger, a French company, makes hardware wallets, small devices that keep your crypto off the internet. On 9 October, 315 of these wallets were emptied in less than an hour, for about $93 million. The Ledger itself was not hacked. The devices involved came from CryptoBilis, a reseller in Southeast Asia, and had been opened before they were sold. A tiny chip hidden inside read the 24 secret words shown on the screen during setup, then sent them to the thieves over the mobile network. And those 24 words are all it takes to empty the wallet.
Ledger says it has not confirmed a single theft on a device bought anywhere other than CryptoBilis. If you bought yours from this reseller, Ledger recommends moving your crypto to a new device, with new secret words. As of 1 November, the investigation led by Ledger's CEO is still going on, and no refund has been announced.
Ledger: a chip hidden in CryptoBilis devices led to the theft of $93 million
On 9 October, 315 Ledger wallets were drained across six blockchains in about 47 minutes. Bitquery puts the haul at $93.2 million, including $70.5 million on Tron, mostly in USDT. Tether froze about $10 million of it, and the thieves converted about $14.9 million into USDD, a stablecoin that Tether does not control.
Ledger confirmed the cause on 13 October. An implant had been slipped into the casing of devices sold by CryptoBilis, its official reseller in Malaysia, Indonesia and the Philippines. It read the recovery phrase on the screen during setup and sent it by eSIM over the mobile network. The Secure Element, the operating system and transaction signing are intact, but the Genuine Check, Ledger's authenticity check, does not see these additions.
As of 1 November, Ledger has not given any total, and estimates range from $86 million to $103 million. Its CEO, Pascal Gauthier, says he is leading the investigation himself to find out who modified the devices, and at what stage. No refund or arrest has been announced. MediaMarkt pulled Ledger devices from its shelves after a report in Germany, even though Ledger considers the stock it checked there to be clean. Trezor issued the same alert about this reseller on 30 October.
Read the expert version
Ledger: the LTE implant in CryptoBilis devices drained 315 wallets in 47 minutes
The victims had received small test amounts about two weeks earlier. On 9 October, 315 wallets were drained across six chains in about 47 minutes, including 111 Bitcoin addresses in a single block and 25 Tron wallets signed within three seconds. Bitquery counts about $93.2 million, including $70.5 million on Tron. Tether froze roughly $10 million, but $14.9 million went into USDD, which cannot be frozen. One scammer even lost $4.9 million in BTC to the attack.
This is a physical supply chain attack. A microcontroller housed in the casing decoded the screen while the 24-word seed was displayed and sent it over LTE via eSIM. The Secure Element, the OS and the signing path are sound, but the seed is enough to derive every key. The Genuine Check vouches for the original chip, not for the absence of anything added. Ledger had CryptoBilis's sales suspended on 9 October and confirmed the implant on 12 October and 13. The founders of CryptoBilis say they sold the company in March 2026.
As of 1 November, Ledger has not confirmed any total (Galaxy Research puts it at around $91 million). Pascal Gauthier is running the investigation, and no compensation or arrest has been announced. Cases are coming in from Japan, Thailand and Singapore's airport, where Mark Karpelès reported a Ledger Flex, without confirmation from Ledger. MediaMarkt has suspended its sales, and on 30 October Trezor asked CryptoBilis buyers to make the same migration.
