Key Points
▶ Confirmed total now $102M drained from 324 wallets across 6 chains (TRON, Bitcoin, Ethereum, Solana, BNB Chain, Polygon), up from early estimates of $86 to 93M.
▶ A STM32G431KBU6 microcontroller with eSIM and LTE module was physically installed behind the OLED screen in compromised devices, transmitting seed phrases over mobile data.
▶ All confirmed victims purchased through CryptoBilis, an authorized Ledger reseller in Malaysia, Indonesia, and the Philippines that underwent 100% ownership change in August 2026.
▶ Ledger’s Genuine Check does not detect the implant. It verifies the Secure Element only, which was untouched in compromised devices.
▶ On October 15, Ledger announced new global reseller rules: no shelf display of devices, no resale of returns, mandatory suspicious hardware reporting, and immediate suspension of Southeast Asia and Hong Kong authorized reseller sales.
▶ Tether froze $10M in USDT across 37 attacker addresses. Approximately $84M remains traceable on-chain.
Ledger has confirmed a hardware supply chain attack through authorized reseller CryptoBilis in which modified Ledger Nano devices were shipped to customers with a covert cellular implant pre-installed. As of October 15, on-chain analysis firms put confirmed losses at $102 million drained from 324 wallets across six blockchains. Ledger responded the same day by announcing mandatory new rules for all authorized resellers worldwide and suspending reseller sales across Southeast Asia and Hong Kong.
The attack exploited the physical distribution layer, not Ledger’s firmware or Secure Element. Devices that passed Ledger’s Genuine Check were among those compromised, because the check verifies only the cryptographic integrity of the Secure Element, which the implant left untouched.
How the Implant Worked
Hardware security researcher Mark Karpeles, former CEO of Mt.Gox, published a teardown of his own CryptoBilis-sourced device on October 11, 2026, before Ledger’s official confirmation. He identified a STM32G431KBU6 microcontroller with an integrated eSIM and LTE module installed in the gap behind the OLED screen in a modified PCB layer.
The implant intercepted the display output and button inputs during the device setup process, capturing the 24-word BIP-39 seed phrase as it was displayed to the user and transmitting it over LTE to attacker-controlled servers. The device continued to function normally afterward, giving victims no indication their wallet had been compromised at point of setup.
Ledger confirmed the implant finding and said it was conducting a full audit of CryptoBilis inventory in cooperation with the reseller. The device exterior and packaging showed no visible signs of tampering. Ledger’s Genuine Check returned a passing result on implanted units.
CryptoBilis: Authorized Reseller, Changed Hands in August
CryptoBilis was an authorized Ledger reseller operating in Malaysia, Indonesia, and the Philippines. Corporate records show 100% ownership transferred to a new shareholder listed at a Chinese address in August 2026, roughly two months before the first victim reports emerged. The new ownership was subject to a non-disclosure agreement, the terms of which have not been made public.
Ledger has asked CryptoBilis to halt all sales and shipments of Ledger devices. CryptoBilis complied and is no longer selling hardware wallets while the investigation continues. Ledger CEO Pascal Gauthier stated in a post on X that the company is leading the investigation at the executive level and working to identify the responsible parties.
Scale of Losses: $102M Across Six Chains
On-chain analysis by Bitquery, covering data through October 13, confirmed $102 million drained from 324 wallets. That is higher than the $86 to 93M range cited in initial reports, which were drawn from a smaller sample of ten public addresses. The six affected chains are TRON, Bitcoin, Ethereum, Solana, BNB Chain, and Polygon. Some victims held assets on multiple chains; Bitquery identified 58 unique EVM wallets among the 324.
TRON accounts for the largest single-chain share. Bitcoin holdings (203.8 BTC) had not moved as of October 13, consistent with an attacker managing exposure on the most traceable chain. ETH proceeds were being routed through Tornado Cash. Approximately $84M remained traceable on-chain across identified attacker addresses.
Asset Freezes: Tether, and a Potential Circle Action
Tether froze $10M in USDT across 37 attacker-linked addresses. Twenty of those addresses still hold the frozen funds. Tether did not publicly comment on the timeline or circumstances of the freeze.
Bitquery identified two wallets with apparent ties to the attacker holding a combined 2.38M USDC, which Circle has the technical ability to freeze. As of October 13, Circle had not publicly confirmed any action on those addresses.
Ledger’s October 15 Reseller Rule Changes
Ledger announced updated mandatory requirements for all authorized resellers on October 15. The three core changes:
No shelf display. Retailers must keep Ledger devices in storage and hand them to customers only after a completed purchase. Open display on shelves or counters is no longer permitted.
No resale of returns. Any device returned by a customer must be destroyed or returned to Ledger. Resale of returned units is prohibited without exception, even if packaging appears factory-sealed.
Mandatory reporting. Retailers must notify Ledger promptly when customers report unusual device behavior or suspicious hardware characteristics.
In addition to the rule changes, Ledger immediately suspended authorized reseller sales across Southeast Asia and Hong Kong while the investigation into the distribution chain continues. Ledger said the rules around returns and resale already existed but would now be enforced without exceptions.
What Ledger Users Should Do Now
If you purchased a Ledger device through any channel other than ledger.com or a verified major retailer, Ledger recommends treating the device as potentially compromised.
▶ Do not use the device to set up a new wallet or enter a seed phrase.
▶ If you have already used the device and your seed phrase was displayed during setup, move all assets to a wallet generated on a clean, uncompromised device immediately.
▶ Contact Ledger support with your purchase receipt and device serial number.
▶ CryptoBilis-sourced devices cover Malaysia, Indonesia, and Philippines purchases. Southeast Asia and Hong Kong reseller purchases are now also suspended pending review.
Frequently Asked Questions
Was my Ledger device affected?
All confirmed cases involve devices purchased through CryptoBilis, a reseller operating in Malaysia, Indonesia, and the Philippines. Ledger confirmed its direct channel at ledger.com was not compromised. If you purchased elsewhere, your device is not currently linked to the attack, though Ledger has suspended authorized reseller sales across Southeast Asia and Hong Kong as a precaution.
Does Ledger’s Genuine Check detect the implant?
No. The Genuine Check verifies the Secure Element chip only. The implant is a physically separate component installed behind the OLED screen and operates entirely outside the Secure Element. Compromised devices passed the Genuine Check.
What happened to the stolen funds?
Tether froze $10M in USDT across 37 attacker addresses. Bitcoin holdings (203.8 BTC) had not moved as of October 13. ETH proceeds were flowing through Tornado Cash. Bitquery identified 2.38M USDC in attacker-linked wallets that Circle could potentially freeze. Approximately $84M remained traceable on-chain.
What new rules did Ledger announce on October 15?
Ledger mandated three new reseller requirements globally: no shelf display of devices, no resale of customer returns under any circumstances, and mandatory reporting of suspicious hardware to Ledger. Authorized reseller sales across Southeast Asia and Hong Kong were immediately suspended.
Who is Mark Karpeles and why is he relevant?
Mark Karpeles was CEO of Mt.Gox, the Bitcoin exchange that collapsed in 2014. He independently published a detailed hardware teardown of his own CryptoBilis-sourced Ledger device on October 11, 2026, identifying the STM32G431KBU6 implant before Ledger’s official confirmation.
Further Reading
The broader regulatory environment the Ledger attack sits inside: Hoskinson’s arguments on CBDC architecture and blockchain oversight at the UN General Assembly.
How self-draining smart contract scams are exploiting AI branding and trusted content platforms to target retail investors.
Privacy-preserving infrastructure arguments relevant to the question of what self-custody security actually requires in 2026.
Sources: Bitquery on-chain investigation, CoinDesk (October 12 to 13, 2026), crypto.news Ledger reseller rule changes (October 15, 2026), Pascal Gauthier X statement, Mark Karpeles hardware teardown (October 11, 2026) | Updated October 15, 2026 | CryptoNewsBytes.com | Not financial advice.
