Ledger has confirmed a physical hardware attack on wallet devices sold through CryptoBilis, an authorized reseller operating in Southeast Asia. On October 15, 2026, the French manufacturer publicly acknowledged tampering in its distribution chain and announced new rules for retail partners. As of October 19, the theft is real, but Ledger has not certified the total funds stolen or the number of victims affected.
The core mechanism is striking in its simplicity: authentic devices, a hidden electronic component, and a recovery phrase intercepted before the owner could ever protect it. For anyone relying on self-custody to secure their crypto, this attack reshapes how physical security must be evaluated.
CryptoBilis and the Hidden Implants
On October 9, Ledger launched an investigation after customers reported their wallets being drained following purchases from CryptoBilis, an authorized reseller identified by press reports as active in Indonesia, Malaysia, and the Philippines. The following day, Ledger confirmed an unauthorized component inside a device belonging to one of the affected users. On October 13, the Ledger Donjon security lab publicly described how the tampering worked. October 15 brought the company's most complete reconstruction of the incident.
In its October 15 statement, Ledger attributed the operation to an organized criminal group that purchased authentic devices, opened them to install purpose-built components, and then reintroduced them into the commercial supply chain. According to the company, the preparation took months and included servers to collect recovery phrases and infrastructure to transfer and launder stolen funds. These details come from Ledger's internal investigation; the identities of those responsible and the precise point in the supply chain where devices were altered have not been made public.
The distinction from a counterfeit product matters. The hardware wallets involved were genuine devices with authentic security components. It was the physical object, not the cryptographic key stored in the chip, that had been modified. To understand what a genuine device normally verifies, it helps to separate the Ledger security architecture from the guarantees offered by the retail chain.
How a Circuit Read 24 Words Without Breaching the Secure Element
During initial setup, a Ledger wallet displays a 24-word recovery phrase on its screen. Anyone who holds a copy of that phrase can reconstruct the wallet's keys on a different device and transfer all assets, no PIN required. According to the October 13 technical description attributed to Ledger Donjon, the hidden implant read the words displayed on screen and transmitted them over an LTE cellular network via an embedded eSIM. Attackers could therefore obtain the secret before the user ever began normal operation of the device.
The most sensitive aspect concerns authenticity checks. Ledger operates a cryptographic verification called the Genuine Check, which confirms the presence of an original Secure Element. The threat model itself acknowledges, though, that a spy circuit added to the hardware can pass undetected if the secure component remains intact. Passing the Genuine Check proves the chip is authentic; it does not guarantee the absence of every additional component added to the physical device. This is a limitation Ledger acknowledges openly, not evidence that every Ledger wallet can be compromised remotely.
This attack did not require the victim to type their words into a fraudulent website. It differs, for instance, from the fake letters circulated under Ledger's name that tried to trick customers into voluntarily revealing their seed phrase. In the CryptoBilis case, the phrase was exposed at the exact moment the user believed they were setting up a brand-new device.
Estimated Losses: $86 to $102 Million, But No Official Total
The first on-chain analyses cited by The Block on October 9 pointed to suspicious outflows exceeding $72 million, then $86 million. Those were estimates built by linking blockchain addresses to suspected thefts, not figures approved by Ledger. In the days that followed, figures above $90 million circulated, with differing perimeters and methodologies. They should not be added together: they may refer to the same transactions.
An analysis published by Bitquery and updated to October 16 attributes approximately $102 million in outflows from presumed victim wallets across six blockchains: Tron, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. According to Bitquery's breakdown, roughly $79.3 million moved on Tron, $16.8 million on Bitcoin, $3.7 million on Ethereum, $1.45 million on BNB Chain, $0.58 million on Polygon, and $0.25 million on Solana. This is a private on-chain investigation that requires address attribution and cannot independently identify the cause of each individual loss.
Ledger itself has published neither a definitive damage figure nor a verified count of affected customers. That is the primary caveat to keep in mind across headlines, charts, and social shares: the hardware attack mechanism is confirmed, while the $102 million figure remains a Bitquery estimate, not an official company number.
The German Case Does Not Confirm a Europe-Wide Theft Wave
On October 13, the MediaMarktSaturn retail chain suspended in-store and online sales of Ledger devices after a customer in Germany reported a possible physical implant. The Block reported the chain's decision and noted that no fund losses were confirmed in that specific case. Separately, claims about additional tampered devices in Europe appeared on social media, not all independently verified.
In its October 15 statement, Ledger explained it had conducted test purchases in Germany and opened samples taken from stores and warehouses. According to the company, those examined showed no signs of tampering. That result does not automatically dismiss every individual report. It does not support describing a confirmed European network of compromised devices either. As of October 19, the thefts Ledger has confirmed remain tied to the CryptoBilis circuit in Southeast Asia.
Temporary Sales Halt and New Distributor Rules
Ledger's response goes beyond technical analysis. The company asked authorized resellers and distributors in Southeast Asia and Hong Kong to suspend sales during the verification period. Ledger stated it had engaged law enforcement and security communities to track fund movements and identify the criminal infrastructure. The company also announced it would release additional technical details as soon as doing so would not compromise the ongoing investigation.
On October 15, Ledger established operational requirements for its authorized network: returned devices cannot be resold, even if they appear sealed and new; devices must not be displayed on shelves but kept in back-of-store storage and handed over only at the point of purchase. Stores are required to report any anomalies promptly. These are measures against supply chain manipulation, not a firmware fix for a Secure Element vulnerability.
Other manufacturers also reviewed their distribution networks. According to The Block, Trezor announced audits and a reduction in the number of authorized resellers, while reporting no evidence of compromised Trezor devices in this incident. The case fits into a broader conversation: a customer data breach, like the episodes SpazioCrypto analyzed for Trezor and SafePal, carries different risks than the physical tampering of a device.
Should Ledger owners replace their device?
Based on publicly available information, there is no blanket recommendation to replace all Ledger devices. The first check is where the device was purchased. In its initial communications, Ledger urged anyone who had bought from CryptoBilis within the prior 90 days not to configure the device if still unused; those who had already set it up were advised to consider transferring funds to a new, secure wallet generated with a fresh recovery phrase. Copying the old phrase onto a new device does not eliminate the risk if that phrase was already intercepted.
Where a loss has occurred, the company recommended coordinating with law enforcement before physically opening the device, since it could serve as evidence. Users should contact only official support channels and never share their 24-word seed phrase with anyone claiming to be a technician, investigator, or fund-recovery operator. An apparently intact packaging and a passed Genuine Check, taken alone, cannot reconstruct the full physical history of a wallet.
For those who did not buy from CryptoBilis and have observed no anomalies, this incident does not constitute proof that their own device is compromised. Staying familiar with the different attack types covered in the SpazioCrypto security section remains worthwhile: phishing, seed-phrase theft, personal data exposure, and supply-chain manipulation each call for distinct precautions.
Italy's situation: the risk is about sourcing, not a nationwide flaw
As of October 19, no official sources examined by SpazioCrypto have attributed fund losses to Ledger devices sold in Italy within this investigation. The German episode shows why the issue is relevant to the European market as a whole, but it does not prove that compromised batches exist in every country. No verified communication requires Italian Ledger owners to stop using their wallets indiscriminately.
The practical guidance is to keep records of the seller, avoid used or pre-configured devices, and check for updates exclusively through official Ledger channels. If a concrete link to a reseller or a batch under investigation emerges, the priority is to follow the manufacturer's specific instructions, not to act on private messages or links received after the attack was announced.
The bigger picture
Our read is that this episode shifts the security perimeter of hardware wallets from inside the chip to the product's commercial journey. A device can be cryptographically authentic and, at the same time, carry an external component capable of observing a secret. That does not mean hardware wallets have lost their purpose. It means self-custody cannot be reduced to a technical certification: it also demands verifiable sourcing, auditable sales procedures, and fast responses to any sign of tampering.
The next measurable milestones will be the publication of an independently verifiable technical report, the possible identification of those responsible, a final tally of losses, and demonstrated effectiveness of the new distribution controls. Until then, the most accurate framing is a confirmed hardware attack with investigations and damage estimates still open, not a universal vulnerability affecting all Ledger wallets.
