Tampered Ledger wallets sold through a reseller drain an estimated $90 million to $93 million
October 9, 2026 (October 9 to 15, 2026)
Thefts began around October 9 from more than 300 wallets, mostly in Southeast Asia, with estimates of $90 million to $93 million across several blockchains. Ledger confirmed on October 10 that an affected customer's device contained an unauthorized hardware implant. Ledger says a highly organized criminal group bought genuine devices, fitted implants able to read recovery phrases, and fed them back into the supply chain through resellers. The confirmed cases involved purchases through the reseller CryptoBilis. Ledger says its chip, operating system and servers were not compromised and its own sales channel was unaffected. One report says a researcher found a similarly modified device at a German retailer. Ledger has told recent reseller customers not to set up new devices.
Why it matters
This was not a software bug. Genuine devices were physically altered before sale, and according to one analysis the leak channel used the device's own cellular hardware, so antivirus or network monitoring would see nothing. No attacker has been identified.
What defenders can take from it
- Buy hardware wallets only directly from the maker, and check the device and packaging for signs of tampering.
- If you bought a wallet from a reseller recently, follow the maker's integrity-check instructions before using it.