What happened
On October 9, 2026, Ledger began investigating unexpected asset drains involving users who had bought devices through CryptoBilis. Ledger said all confirmed reports of unexpected fund drains involved devices sold through Southeast Asian reseller CryptoBilis. The company advised purchasers not to initialise unused devices and advised users of configured devices to consider moving assets to a new signer with a new seed. Ledger said its own systems and direct sales channels were not affected.
On October 10, 2026, Ledger said one affected device contained an unauthorised hardware implant. Independent researchers analysing Ledger Nano X devices reported an ST STM32G431KBU6 microcontroller, a 2×2 mm eSIM and a shielded LTE module in one implant design. Reporting said the circuitry could capture display output and button presses and transmit recovery words. Ledger did not publicly confirm that mechanism for every affected device.
On October 12, 2026, Bitquery revised its on-chain estimate to $102.0 million taken from 324 wallets across six chains. Bitquery said 6,680 ETH entered Tornado Cash from October 9 through October 12, while Tether froze $10.0 million in USDT. The research found coordinated signing behaviour and concluded that one operator held the keys, but blockchain records cannot establish how each recovery phrase was obtained.
Ledger’s Genuine Check cannot detect an added implant when the original Secure Element remains intact. Ledger did not publish a complete affected-device serial list or confirm that every drained wallet used an implanted device. The cited sources did not establish where or when the devices were modified within the distribution chain. Attribution posture: The on-chain activity is linked behaviourally to one operator, but no person, criminal group, reseller employee or supply-chain participant has been publicly attributed responsibility. The cited source did not publish the precise timeline detail described as The tampering point remains unresolved.
Why this matters now
The incident defeats a common assurance assumption: genuine core components and successful software authenticity checks do not prove that a physical device has not been modified around them. Enterprises using hardware signers for treasury, custody, privileged administration or recovery should treat reseller provenance, returns handling and physical inspection as parts of the security boundary.
The updated on-chain analysis makes the event material beyond an isolated device defect. Hundreds of wallets across multiple chains were drained by an operator who had the keys, while Ledger has confirmed an implant in only one examined device. That distinction requires urgent containment without assuming that every loss has the same physical cause.
Replacing a device without replacing its recovery phrase does not contain a stolen seed. Response owners must treat the phrase as the compromised secret, move assets through an approved multi-party process, and preserve suspect hardware for examination. Procurement and custody teams also need a complete record of resellers, serials, returns and custodians.
The decision for security leaders
Treat the recovery phrase as the asset requiring containment. A replacement device using the same seed preserves the attacker’s access. Treasury or custody leaders should approve migration through an established multi-party process that minimises new concentration risk and records every destination and authorisation.
Expand the review beyond named wallet users. Identify hardware signers used for treasury, privileged recovery, code signing and other high-impact cryptographic operations. For each device, prove purchase channel, custody, packaging integrity, return history, firmware state and whether any authenticity check excludes only software tampering.
Require reseller assurance to cover physical-chain controls, not merely authorised status. Contracts and audits should address inventory custody, returns, refurbishment, shipment integrity, serial reconciliation and incident notification. Devices with unprovable provenance should move to an explicit exception or replacement process.
Evidence of closure
- Procurement ledger identifies reseller, serial number, custodian and status for every signer.
- New seed and signer activation records confirm migration from affected provenance.
- Physical inspection record documents device integrity or approved disposal.
- Transaction monitoring shows no unauthorised movement after migration.
The Security.io assessment
Ledger has confirmed an implant in one affected device, which is sufficient to establish a real hardware-tampering risk but not sufficient to attribute every loss to the same mechanism. Bitquery’s analysis independently establishes coordinated key possession and significant asset movement, while leaving the original secret-acquisition path unresolved.
The control failure is broader than hardware-wallet security. Enterprises often treat a vendor’s authorised-reseller designation and device authenticity check as end-to-end provenance. The reported Genuine Check limitation shows that an original Secure Element can coexist with unauthorised surrounding hardware, leaving physical inspection and distribution controls outside the attested boundary.
Closure requires evidence that suspect seeds are retired, assets are moved under controlled approvals, devices are quarantined, procurement records identify provenance and no unauthorised transactions continue. A vendor statement that internal systems were unaffected does not close customer-side compromise created elsewhere in the distribution chain.
Questions for the morning meeting
- Can every signing device be traced to an authorised procurement path?
- Which business processes depend on hardware-wallet signers?
- Can assets be migrated without concentrating approval risk?
- How are returned devices prevented from re-entering trusted inventory?