Ledger confirms a hardware implant in a CryptoBilis wallet: what we know and where the stolen coins are going

What Ledger confirmed

On Saturday, October 10, Ledger's support team posted on X that "one of the impacted users' devices contained an unauthorized hardware implant." It is the first official confirmation that at least one wallet in the CryptoBilis reseller case was physically altered. A day earlier, a tampered device was only one of three theories.

The rest of the statement, as reported by Bitcoin.com News and The Defiant, comes down to a few points:

• the company has "no indication that Ledger's security infrastructure, systems or services have been compromised";
• Ledger is reaching out to impacted users as part of the ongoing investigation and asks anyone with information to write to its bug bounty program;
• the company is working with law enforcement and thanked the SEAL 911 group for its help;
• it is working on "further, enhanced anti-tampering solutions";
• Ledger never asks for your 24-word recovery phrase.

What the statement leaves out matters just as much. Ledger did not name the device model and did not say the implant caused all of the thefts. How many wallets are affected and how the implant relates to the withdrawals is still under investigation. CryptoBilis, an official Ledger reseller in Indonesia, Malaysia and the Philippines, has halted sales of all hardware wallets until it is over.

How the Ledger hardware implant works, according to researchers

The details come only from independent researchers, and Ledger has not confirmed them. Former Mt. Gox CEO Mark Karpeles examined a modified Ledger Nano X. By his account, an extra board with a cellular module is hidden inside the case. It does not break the Secure Element chip. The implant intercepts the data sent to the screen during setup, meaning the words of the seed phrase, and transmits them over the cellular network.

Such devices reportedly passed Ledger's standard authenticity test, the Genuine Check. The company has not confirmed that either. Nor has anyone established that every affected wallet carried this hardware: Ledger's statement lends weight to Karpeles's account, but the company has not directly linked his device to the implant it found.

If the description is accurate, the takeaway for owners is uncomfortable. An authenticity check in the app and an intact chip do not guarantee that nothing was added inside the case, and the seed phrase leaks the moment the screen displays it, before the first deposit. You can receive coins from anywhere: an exchange account, a friend, or a crypto exchange that pays out straight to your own address. But they are only worth storing on a device with nothing extra inside.

How much was stolen: $86, $90 or $93 million

There is no single figure, and Ledger has not confirmed any of the estimates. Analysts are tracking addresses across Bitcoin, Ethereum and TRON, and they count differently.

Bitquery and Yfarmx nearly agree on the total but differ on the number of addresses: 311 versus 471. The Specter and tanuki42 estimates date from the first day, October 9.

Where the stolen coins are going

In the first few days, three routes have become visible.

Frozen USDT

According to Bitquery, Tether has frozen about $10 million in USDT across 20 wallets. The first addresses were blacklisted at around 12:09 UTC on October 9, and they include a recipient address holding 500,000 USDT on TRON. A day earlier we used the THORChain case to explain how Tether freezes USDT on other people's addresses.

A freeze by itself does not return money to victims, and nobody knows how much will be recovered. But there is no other lever: the issuer can stop USDT, while nobody can stop bitcoin or ether.

Swaps into USDD

The thieves know this. Bitquery estimates that 14.9 million USDT was swapped for USDD, a TRON stablecoin that Tether cannot freeze. The Defiant describes one such wallet: 2 million USDT went into USDD in four trades of 500,000 USDT each between 11:26 and 11:32 UTC on October 9, more than half an hour before the first freezes. We have a separate USDT and USDC comparison covering who can freeze a stablecoin and when.

Tornado Cash

On October 10, a wallet that MistTrack links to the thefts sent 468.9 ETH to an intermediary address at 09:42 UTC. Then, according to The Defiant, four addresses made 23 deposits into Tornado Cash totaling 464 ETH, about $1.16 million, between 10:07 and 10:10 UTC. Roughly 700 ETH remained on the original address. Onchain Lens gives a different figure: 430.2 ETH, about $1.07 million, through four wallets. Nobody has explained the gap.

Bitquery also traced part of the funds through Tornado Cash and Zcash by matching amounts and timing. It calls this strong evidence, but not proof. The U.S. Treasury sanctioned Tornado Cash in August 2022 and lifted the sanctions in March 2025, and the mixer itself runs as a smart contract that nobody can switch off. The coins still carry a trail, though: we have explained why a transfer tainted by theft or a mixer gets stopped at an AML check.

What hardware wallet owners should do

Ledger's guidance has not changed. If you bought a device from CryptoBilis in the last 90 days and have not set it up, don't. If you already have, consider moving your coins to a new Ledger device with a new seed phrase.

Let's be honest: if the implant is hardware, no check in the app will neutralize it. The only reliable fix is moving to a different device with a new phrase generated on that device. Never carry the old phrase over: once someone else has seen it, it is compromised for good.

Everyone else can use the hardware wallet checklist from our first report on the case: where the device was bought, where the seed phrase came from, what the screen shows. Buy the new wallet from the manufacturer.

While moving funds, watch out for address poisoning in your wallet history and copy the new address only from the new device's screen. And don't trust "recovery services" or "support" that contact you first: real support never asks for your 24 words.

How to move crypto to a new wallet and swap it without registration

Switching to a new seed phrase means every coin has to be sent to a new address anyway. You can swap it along the way if you have been meaning to reshape your holdings: for instance, keep less of a stablecoin the issuer can freeze and more bitcoin.

With VertEXchange you don't need an account, an email or a phone number for that. You pick a pair, paste the new wallet address copied from the device screen, and see the rate and the amount you will receive before you send anything. That way you can exchange USDT TRC20 to BTC without registration or swap ETH to BTC straight to your own address.

• A fixed rate holds for about 15 minutes, enough time to check the address on your wallet's screen.
• VertEXchange does not hold your coins; they go straight to your address.
• If the exchange does not go through, the coins return to your refund address.
• Personal fields of an operation are deleted 24 hours after it completes, and your exchange history stays only in your browser.
• Support chat is on every page, and questions are handled by exchange code.

FAQ

What did Ledger confirm on October 10, 2026?

An unauthorized hardware implant was found in the device of one impacted user. The company did not name the device model, and the implant's link to the thefts and the number of affected wallets are still under investigation.

Was Ledger itself hacked?

According to the company, there is no indication that its infrastructure, systems or services have been compromised. The implant was found in an impacted user's device, and CryptoBilis has halted hardware wallet sales until the investigation ends.

What is the Ledger hardware implant?

Ledger has not shared details. According to Mark Karpeles, who examined a modified Nano X, it is an extra board with a cellular module that intercepts seed phrase words on their way to the screen and sends them out over the cellular network. The company has not confirmed this description.

How much was stolen from CryptoBilis buyers?

Bitquery puts the losses at about $92.9 million from 311 addresses, Yfarmx at about $93.4 million from 471 addresses, and MistTrack says the total is approaching $90 million. Ledger has not confirmed any of these estimates.

Can the stolen coins be recovered?

Only USDT stands a chance: according to Bitquery, Tether has frozen about $10 million across 20 wallets. A freeze is not a refund yet, and it is unknown how much victims will get back. Nobody can freeze bitcoin or ether.

Is it safe to buy a hardware wallet from a reseller?

The CryptoBilis case showed that even an official reseller can have problems. Buying from the manufacturer is safer, and the seed phrase should only ever be generated on the device itself. If in doubt, a new device and a new phrase are the way out.