Executive Summary
On October 9, 2026, reports emerged of significant cryptocurrency thefts affecting users who purchased Ledger hardware wallets through the Southeast Asian reseller CryptoBilis. Subsequent investigations by Ledger confirmed the presence of an unauthorized hardware implant in at least one affected device, marking the first concrete evidence of a supply chain compromise targeting hardware wallets. All confirmed cases involve devices sold exclusively through CryptoBilis, with no evidence of compromise in Ledger’s direct sales channels or internal systems. Estimated losses range from $86 million to $93 million, impacting over 300 wallets across multiple blockchains, including Bitcoin, Ethereum, and Tron. Ledger has advised customers who purchased devices from CryptoBilis not to initialize unused wallets and to migrate funds to a new device obtained directly from Ledger. The company is actively contacting affected users, cooperating with authorities, and has reiterated that its internal infrastructure remains uncompromised. CryptoBilis has suspended all hardware wallet sales pending the outcome of the investigation.
Technical Information
The incident represents a sophisticated supply chain attack, wherein an unauthorized hardware implant was physically inserted into Ledger hardware wallets distributed by CryptoBilis. This implant was discovered following reports of unauthorized fund withdrawals from wallets initialized on these devices. The attack vector is confirmed as a hardware-based compromise, with all evidence indicating that only devices sold through CryptoBilis were affected. There is no indication that Ledger’s manufacturing facilities, internal systems, or direct sales channels were breached.
Implant Design and Functionality
The unauthorized implant consisted of a custom circuit board concealed beneath the device’s screen, occupying the space typically reserved for display padding. Technical analysis and photographic evidence provided by a researcher revealed that the implant included a microcontroller, an antenna, an LTE chip, and an e-SIM card. The implant’s primary function was to monitor the device’s display during the wallet initialization process, capture the user’s seed phrase as it appeared on the screen, and transmit this sensitive information to attacker-controlled infrastructure via the cellular network (LTE/eSIM). With the seed phrase compromised, attackers could reconstruct the wallet on a separate device and drain funds at will, without further interaction with the original hardware.
Detection and Evasion
The implant was engineered to evade standard authenticity checks. Devices containing the implant passed Ledger’s Genuine Check, as the security chip remained unaltered and authentic. The only reliable method for detecting the implant was through physical disassembly and inspection of the device. The packaging of affected devices appeared intact, with shrink wrap undisturbed, further complicating detection by end users and resellers.
Attack Execution
The attack unfolded as follows: compromised hardware wallets were distributed via CryptoBilis to customers in Indonesia, Malaysia, and the Philippines. Upon initialization, the implant activated, captured the seed phrase, and exfiltrated it via the embedded LTE/eSIM module. Attackers then used the stolen seed phrases to reconstruct wallets and execute coordinated fund drains, which were first widely reported on October 9, 2026. The scale and timing of the thefts suggest that attackers may have collected seed phrases over an extended period before executing the thefts in a single wave.
Technical Attribution and Confidence
The technical evidence supporting this analysis is robust, including physical teardown, photographic documentation, and corroborated statements from Ledger and independent researchers. However, no digital artifacts (such as malware hashes, malicious domains, or IP addresses) have been identified, as the attack was entirely hardware-based. Attribution to a specific threat actor remains unconfirmed, though the sophistication and regional targeting suggest a well-resourced adversary with access to the hardware supply chain in Southeast Asia.
MITRE ATT&CK Mapping
The attack aligns with several MITRE ATT&CK techniques: - T1195.002 – Supply Chain Compromise: Compromise Hardware Supply Chain: The attacker inserted a malicious hardware component during the supply chain process, targeting devices before they reached end users. - T1056 – Input Capture: The implant captured sensitive information (seed phrase) as it was displayed to the user. - T1041 – Exfiltration Over C2 Channel (adapted: Exfiltration Over Cellular Network): The implant exfiltrated the captured seed phrase via LTE/eSIM, outside the user’s network.
Sector-Specific Targeting
The attack exclusively targeted cryptocurrency users in Southeast Asia who purchased Ledger wallets from CryptoBilis. All confirmed victims acquired their devices from this single reseller, indicating a highly targeted supply chain attack rather than a broad, indiscriminate campaign.
Impact Assessment
On-chain analysis by independent researchers estimates that between $86 million and $93 million was stolen from over 300 wallets across multiple blockchains. Ledger has not independently confirmed these figures but acknowledges the scale of the incident. The company has reiterated that its internal security infrastructure, systems, and services remain uncompromised.
Affected Versions & Timeline
The affected products are Ledger hardware wallets sold through CryptoBilis in Southeast Asia, specifically in Indonesia, Malaysia, and the Philippines. The timeline of the incident is as follows: In June 2026 or later, compromised devices began reaching customers, as indicated by blockchain analytics tracing the first deposits to affected wallets. On October 9, 2026, reports of unauthorized fund withdrawals surfaced among CryptoBilis customers. On October 10, 2026, Ledger confirmed the discovery of an unauthorized hardware implant in at least one affected device. By October 11, 2026, CryptoBilis had suspended all hardware wallet sales, and Ledger began contacting affected users and cooperating with authorities. As of October 12, 2026, the investigation is ongoing, with all confirmed cases linked to devices sold through CryptoBilis.
Threat Activity
The threat activity centers on a highly targeted supply chain attack against Ledger hardware wallets distributed by CryptoBilis. The attacker(s) inserted a custom hardware implant into the devices, enabling the capture and exfiltration of seed phrases during wallet initialization. The attack was executed with a high degree of operational security, as the implant was undetectable by standard authenticity checks and the packaging appeared untampered. The attackers likely collected seed phrases over several months, executing a coordinated theft of funds from over 300 wallets in a single wave on or around October 9, 2026. The use of LTE/eSIM for exfiltration allowed the attackers to bypass local network monitoring and avoid detection by traditional security controls. No evidence has emerged linking the attack to a known threat actor, and no digital indicators of compromise have been identified.
Mitigation & Workarounds
The following mitigation steps are recommended, prioritized by severity:
Critical: Customers who purchased Ledger hardware wallets from CryptoBilis should not initialize unused devices under any circumstances. Those who have already initialized such devices must immediately transfer their assets to a new wallet generated on a device obtained directly from Ledger or another trusted, authorized source, using a new recovery phrase.
High: Organizations and individuals should source hardware wallets exclusively from authorized vendors and avoid purchasing from third-party resellers or secondary markets. Distributors must not restock or resell returned hardware wallets.
Medium: Users should remain vigilant for social engineering attempts exploiting this incident, such as phishing emails or fraudulent support contacts. Ledger has reiterated that it will never request a user’s 24-word recovery phrase via phone, direct message, or email.
Low: Regularly monitor official Ledger communications and advisories for updates on the investigation and additional security guidance.
Indicators of Compromise
The following caveat applies: Indicators of compromise (IOCs) are point-in-time and should be validated before enforcement. In this incident, no public digital indicators of compromise (such as IP addresses, domains, or file hashes) were available at the time of writing, as the attack was hardware-based and not detectable via traditional IOC scanning.
References
Coindesk, "Ledger Says Unauthorized Implant Found in at Least One Device Sold by CryptoBilis," 2026-10-12: https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis
Help Net Security, "Ledger wallets compromised via hardware implant," 2026-10-12: https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/
Crypto.news, "Ledger confirms hidden chip in crypto wallet amid $92M theft," 2026-10-11: https://crypto.news/ledger-confirms-hidden-chip-in-crypto-wallet-amid-92m/
About Rescana
Rescana provides a third-party risk management (TPRM) platform designed to help organizations identify, assess, and monitor supply chain risks, including those arising from hardware and software supply chain compromises. Our platform enables continuous monitoring of vendor security posture, supports rapid incident response, and facilitates evidence-based risk assessments for hardware and software procurement.
We are happy to answer questions at info@rescana.com.
