Ledger confirms draining cases linked to CryptoBilis-sold devices

The whole point of a hardware wallet is that your keys never touch anything you don’t control. On October 10, 2026, Ledger confirmed that, for some buyers of a Southeast Asian reseller, that promise was quietly broken before the box was opened. Ledger said at least one of its devices sold by reseller CryptoBilis contained an unauthorized hardware implant that gave attackers access to users’ recovery phrases. Estimates put the damage at between $72 million and $93.2 million, drained from 311 to 315 wallets across multiple blockchains. What Ledger found and who got hit The affected devices were purchased from CryptoBilis within the last three months. According to the research findings, this is the first confirmed case of a physical implant in a Ledger device linked to a reseller. Most of the losses landed in one place. Roughly $70 million of the stolen funds were in USDT on the Tron blockchain. The rest was spread around. Losses were also reported on Bitcoin, Ethereum, BNB Chain, Polygon, and Solana, which suggests the attackers simply swept whatever the compromised seed phrases unlocked. Ledger stressed that its own systems and direct sales channels were not affected. The company al...