Ledger confirms hardware implant in a CryptoBilis wallet as loss estimates span $86M to $93M
Ledger confirmed an unauthorized hardware implant inside a wallet sold by Southeast Asian reseller CryptoBilis, while researchers put suspected losses between $86 million and $93.4 million.
Read this event in português (Brasil), 한국어, Türkçe, 中文（中国）, русский
Why it matters
Ledger says its own systems and direct sales channels were not compromised, which points the losses at devices that arrived altered rather than at a flaw in Ledger's software. The company has not determined how many devices contain implants or confirmed that the implant caused the drains, and reports of a tampered unit outside Southeast Asia remain unverified.
Where the sources disagree
Estimated value of stolen funds
May exceed $86 million, per investigator Specter
Cointelegraph
$92.9 million across 311 wallets, per Bitquery
Crypto.News
$93.4 million, per Yfarmx
Bitcoin.com News
$86 million to $93 million from more than 300 wallets, per CoinDesk
CoinDesk
Four outlets cite different totals from different researchers, and Ledger has verified none of them.
Geographic scope of the tampering
All known cases involve wallets distributed through CryptoBilis in Southeast Asia
Cointelegraph, CoinDesk
A suspicious Ledger device purchased from MediaMarkt in Europe may also be compromised
CryptoPotato, Bitcoin Insider
Ledger ties all confirmed cases to its Southeast Asian reseller, while CryptoPotato relays an unverified community post about a device bought at MediaMarkt in Europe.
Date of Ledger's public confirmation
Saturday, Oct. 10, 2026
Bitcoin.com News, Crypto.News, CryptoPotato, CoinDesk
Sunday post on X
Cointelegraph
Most write-ups place the statement on Oct. 10 while Cointelegraph describes it as a Sunday post on X.
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken (confirms ledger)
$86
Cointelegraph
$92
Crypto.News
Cointelegraph reports $86, Crypto.News reports $92 (7% apart).
amount taken (across losses)
$93.4 million
Bitcoin.com News
$86 million
Cointelegraph
Bitcoin.com News reports $93.4 million, Cointelegraph reports $86 million (8% apart).
amount taken (across estimated losses)
$86 million
Cointelegraph
$92.9 million
Crypto.News
Cointelegraph reports $86 million, Crypto.News reports $92.9 million (7% apart).
Key facts
Ledger confirmed that a device belonging to one impacted user contained an unauthorized hardware implant.
Reported by Bitcoin.com News
Ledger says every confirmed case so far involves products sold through the Southeast Asian reseller CryptoBilis.
Disputed figureReported by Cointelegraph
CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.
Reported by Cointelegraph
CryptoBilis halted sales of all hardware wallet inventory, not only Ledger products, until the investigation concludes.
Reported by Bitcoin.com News
Ledger says its own security infrastructure, systems, services and direct sales channels were not compromised.
Reported by Bitcoin.com News
Researcher Mark Karpelès reported finding suspicious electronics behind the screen of a Ledger Nano X in Malaysia.
Reported by Crypto.News
What happened
Ledger said on Oct. 10, 2026 that a device belonging to one affected customer held an unauthorized hardware implant, the company's first confirmation that a wallet was physically altered before it reached its owner. Ledger tied every confirmed case to CryptoBilis, a reseller it had listed as authorized in Indonesia, Malaysia and the Philippines, and said its own security infrastructure, systems and direct sales channel were not compromised. CryptoBilis stopped selling all hardware wallet inventory, and Ledger told buyers not to initialize unused devices and to move assets to a new signer with a fresh seed. The loss estimates do not agree: Specter put the figure above $86 million across Bitcoin, Ethereum and Tron, Bitquery counted $92.9 million across 311 wallets, Yfarmx estimated $93.4 million, and CoinDesk described a range of $86 million to $93 million from more than 300 wallets. Ledger has verified none of those totals and has not said that the implant caused the drains or how many devices carry it. Mark Karpelès, a researcher, reported suspicious electronics behind the screen of a Ledger Nano X in Malaysia, and CryptoPotato relayed an unverified post claiming a device bought from MediaMarkt in Europe was also compromised.
How the story developed
- Update
First reports of wallet losses tied to CryptoBilis purchases
CryptoPotato said its earlier report identified customers who bought through CryptoBilis in Indonesia, Malaysia and the Philippines.
- Official statement
Ledger confirms an unauthorized hardware implant in one affected device
The company said it had contacted affected users and begun working with authorities, while stopping short of linking the implant to the losses.
- First report
First report by Bitcoin.com News
Ledger Confirms Hidden Hardware Implant in Affected User’s Wallet
- Update
CryptoBilis stops selling all hardware wallets
The reseller halted its full inventory, not only Ledger products, and Ledger said it is in contact with the company about next steps.
- Update
Community post claims a tampered device bought at MediaMarkt in Europe
If accurate, the tampering would extend beyond Ledger's Southeast Asian reseller, and no outlet has confirmed it.
- Independent corroboration
Independently corroborated by Cointelegraph
Ledger confirms unauthorized hardware implant; losses may exceed $86M
- Update
Researcher finds suspicious electronics inside a Ledger Nano X in Malaysia
Mark Karpelès reported electronics behind the device screen, ahead of Ledger's own confirmation.
- Update
CoinDesk reports the range of on-chain loss estimates
The outlet put stolen funds at $86 million to $93 million from more than 300 wallets while noting Ledger's systems were untouched.
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 10 Oct 2026, 19:18 UTC: Bitcoin.com News, official — 1 independent source, 1 reports
- 11 Oct 2026, 09:01 UTC: Cointelegraph — 2 independent sources, 2 reports
- 11 Oct 2026, 15:32 UTC: Crypto.News — 3 independent sources, 3 reports
- 11 Oct 2026, 18:37 UTC: CryptoPotato — 4 independent sources, 4 reports
- 11 Oct 2026, 20:08 UTC: Bitcoin Insider — 5 independent sources, 5 reports
- 12 Oct 2026, 07:49 UTC: CoinDesk — 6 independent sources, 6 reports
Affected entities
Original sources
| Publisher | Report | Role | Published |
|---|---|---|---|
| Bitcoin.com News Company, official | Ledger Confirms Hidden Hardware Implant in Affected User’s Wallet | Original | |
| CoinDesk Crypto media | Ledger says unauthorized implant found in at least one device sold by CryptoBilis | Independent | |
| Cointelegraph Crypto media | Ledger confirms unauthorized hardware implant; losses may exceed $86M | Independent | |
| Crypto.News Crypto media | Ledger confirms hidden chip in crypto wallet amid $92M theft claims | Independent | |
| CryptoPotato Crypto media | Ledger Confirms Hardware Implant as Tampered Wallet Reports Allegedly Spread to Europe | Independent | |
| Bitcoin Insider Aggregator | Ledger Confirms Hardware Implant Found in Tampered Wallet Amid European Reports | Syndicated |
Related events
FTX and Alameda-linked wallets transfer $75 million in ether to market maker Wintermute
Onchain data shows FTX bankruptcy estate and Alameda Research wallets sent about $75 million in ether to Wintermute, with the purpose of the transfer unconfirmed.
SWI Group raises €800 million to repurpose former FTX bitcoin miner Genesis Digital for AI data centers
SWI Group raised €800 million from institutional investors to convert Genesis Digital Assets, acquired from FTX bankruptcy, into AI-focused data centers across Europe and the U.S.
CFTC proposes rules for leveraged retail crypto trading and a new exchange registration
The CFTC proposed rules covering margined, leveraged or financed retail crypto trades plus a new 'crypto asset market' exchange registration, opening a 60-day comment period.
Netflix releases trailer for The Altruists, an eight-episode FTX drama premiering Nov. 19
Netflix released a trailer on Oct. 8 for The Altruists, an eight-episode drama about Sam Bankman-Fried and Caroline Ellison, set to premiere on Nov. 19.
Uniswap founder says Sam Bankman-Fried paid seven figures for Uniswap.com domain
Uniswap founder Hayden Adams says Sam Bankman-Fried paid seven figures for Uniswap.com after the Uniswap team refused the owner's asking price.
Senator Lummis Accuses Democrats of Blocking CLARITY Act After Procedural Vote Fails
The CLARITY Act stalled in the Senate on September 15 after a procedural vote fell short, with Senator Cynthia Lummis accusing Democrats of rejecting crypto investor protections they previously sought while Democrats cite unresolved ethics and national security concerns.