Why This Matters

Ledger’s latest update narrows an active investigation to a single distribution point rather than its own manufacturing or sales systems, and the detail that matters most is physical: a hardware implant was found inside at least one affected device, not just a phished seed phrase. That distinction changes what customers and other wallet makers need to check next, since it points to tampering that happened somewhere in a reseller’s supply chain before a device ever reached a buyer.

Key Takeaways

  • Ledger said on Oct. 11 that every confirmed case in the Oct. 9 wallet-draining wave traces to devices sold through reseller CryptoBilis, with its own systems and direct sales channels unaffected.
  • Ledger confirmed an unauthorized hardware implant, a physical component that can expose a device’s recovery phrase, in at least one affected device, but hasn’t said how devices were tampered with.
  • On-chain researchers’ loss estimates range from $86 million to $94.5 million across roughly 300 to 521 wallets, and Tether has frozen $10 million in USDT tied to the theft.
  • OneKey terminated CryptoBilis’s authorization and is offering free replacement devices to buyers affected between March 1 and Oct. 12, 2026.
  • Critics argue Ledger can’t fully separate itself from the incident since CryptoBilis was listed as an authorized reseller on Ledger’s own website.

What the Implant Reveals About the Attack

The hardware implant is the key technical detail in Ledger’s Oct. 11 update, since it points to a different attack path than phishing. According to Ledger’s statement, “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” A hardware implant is a physical component added to a device, capable of exposing the recovery phrase stored on it, meaning a device could be compromised before a buyer ever opens it.

Ledger was careful to note that not every reported theft in the wave traces back to the implant, and the company hasn’t disclosed how the affected devices were tampered with or whether users will be reimbursed. That leaves open whether all confirmed cases share the same tampering method or whether CryptoBilis-sold devices were compromised through more than one route.

The incident is distinct from two earlier episodes involving Ledger. It is separate from a January breach at a vendor that exposed Ledger customer data, and from an April phishing campaign that used a fake Ledger Live app on Apple’s App Store to drain at least $9.5 million after users entered their own recovery phrases, according to CoinDesk. In this case, the attacker appears to have obtained the keys needed to directly empty wallets rather than tricking users into handing them over.

The Numbers Analysts Are Tracing

Estimates of the losses vary by analyst, and Ledger has not confirmed a total. Bitquery traced $93.2 million from 315 wallets across six blockchains, while YFarmX put the figure at $94.5 million from 521 addresses across seven blockchains; other on-chain researchers’ preliminary figures range from $86 million to $93 million across roughly 300 wallets, according to the brief’s sourcing.

Bitquery said about $81 million remained traceable onchain as of Oct. 11, with some funds routed through Tornado Cash and Zcash, and that most of the stolen assets were USDT and TRON tokens. Tether froze $10 million in USDT tied to the theft, a freeze CoinDesk noted matters because stablecoin issuers can block tokens linked to crime in ways bitcoin or ether issuers cannot.

Reseller Fallout and Pushback on Ledger’s Framing

OneKey moved fastest among affected wallet brands. Founder and CEO Yishi Wang said the company terminated CryptoBilis’s authorization, stopped onboarding new dealers, and began re-reviewing every existing one, with dealers whose owners can’t be verified losing their status. CryptoBilis had listed itself as an authorized reseller for Ledger, Trezor, OneKey, Tangem, SafePal and imKey across Malaysia, Indonesia and the Philippines.

OneKey is offering free replacement devices, including used ones, to anyone who bought a OneKey wallet through CryptoBilis between March 1 and Oct. 12, 2026, with applications closing Dec. 31, 2026. The company said none of its own users have reported losses. Ledger’s support page said on Oct. 10 that CryptoBilis will not sell Ledger products pending the end of the investigation, and the company reminded its distributor network to source products exclusively through authorized channels and prohibited restocking returned devices, according to CoinDesk.

Not everyone accepts Ledger’s framing of the incident as contained to one reseller. X user MyCryptoParadise wrote, “It’s not CryptoBilis incident, its Ledger incident. At least take an ownership of this mess, instead of trying to throw it on someone else.” The objection rests on the fact that CryptoBilis was listed as authorized on Ledger’s own website, not an independent or unverified seller.

What to Watch

Ledger said it is working with relevant authorities as the investigation continues, but hasn’t said how tampering occurred, confirmed a total loss figure, or indicated whether affected users will be reimbursed. For now, Ledger’s guidance to anyone who bought through CryptoBilis is to leave unused devices unopened and, for devices already in use, move assets to a new wallet with a freshly generated recovery phrase. The company also warned that scammers are exploiting the incident and said it will never ask users for a 24-word recovery phrase.

OneKey’s replacement-device application window runs through Dec. 31, 2026, and Bitquery’s tracking of the roughly $81 million still traceable onchain as of Oct. 11 remains ongoing, with some funds already routed through mixers.

Sources