Ledger finds a hardware implant in a wallet sold by CryptoBilis

Key points

Ledger told buyers who bought from CryptoBilis in the last 90 days not to set up their device, and told those who already did to move funds to a new device with a new seed.

Loss estimates range from $71.5 million to $93.4 million because the trackers count different chains, different addresses and different cut-off times; Ledger has confirmed no total.

Bitquery timed the first drain at 04:59 UTC on October 9 and saw 25 TRON wallets sign the same approval within 3 seconds, which fits a seed known to the attacker in advance.

Ledger said on October 10 that one drained customer's device "contained an unauthorized hardware implant". The device came from CryptoBilis, the reseller Ledger lists for Indonesia, Malaysia and the Philippines. A day earlier Ledger had asked CryptoBilis to pause all sales and shipments. On-chain trackers count between $72 million and $93 million drained since October 9.

Ledger's October 9 advice is specific. Anyone who bought from CryptoBilis in the last 90 days and has not set the device up should not start. Anyone who already did should consider moving assets to a new Ledger device with a new seed. Ledger says it has "no indication that Ledger's security infrastructure, systems or services have been compromised", and that it is working with authorities and the SEAL 911 volunteer response group.

How a tampered device defeats a hardware wallet

A hardware wallet protects you by generating the 24-word recovery phrase inside the device and never sending it anywhere. A physical implant breaks that promise at the source. If a hidden board can watch the screen or the keys during setup and send the words out, the attacker holds the seed from day one. Every deposit that follows is already theirs to take.

That reading is our analysis of the public evidence, not a Ledger finding. Ledger has not described the implant, said how many devices carry one, or tied it to every reported loss. Gizmodo reported on October 9 that Mark Karpelès, the former Mt. Gox CEO, posted photos of a device bought in Malaysia with a hidden board under the screen padding, an LTE module and an antenna. Ledger has not said whether its confirmed implant matches those photos.

The on-chain pattern fits a pre-known seed. Bitquery timed the first drain at 04:59 UTC on October 9 and saw 25 TRON wallets sign the same approval within 3 seconds, with about $29 million moved within 6 seconds. Victims had funded those wallets over weeks, and the attacker emptied them in one coordinated sweep rather than one phishing victim at a time.

Oct 9, 04:59

First drains

TRON wallets emptied in synchronized batches.

Oct 9

Ledger statement

CryptoBilis asked to pause sales. 90-day buyers warned.

Oct 10, 17:09

Implant confirmed

One affected device held an unauthorized implant.

Oct 11

Trackers converge

Bitquery and Yfarmx both count about $93 million.

Figure 01The public timeline, from Ledger's statements, The Block and Bitquery. Times in UTC.

Why the loss figures disagree

Four trackers have published four totals, and the gaps are about method, not error. On October 9 tanuki42 counted more than $72 million and Specter more than $86 million across Bitcoin, Ethereum and TRON, The Block reported, adding that it was unclear whether the two sets overlapped. Gizmodo's $71.5 million breakdown counted $29.4 million in ether, $17.5 million in bitcoin, $13.6 million in USDD and $10.8 million in USDT.

By October 11 Bitquery counted $93.2 million from 315 wallets on six chains, and Yfarmx $93.4 million across 471 addresses, per Bitcoin.com News. Bitquery's split by origin chain is TRON $70.5 million from 131 wallets, Bitcoin $16.8 million from 122, Ethereum $3.7 million from 33, BNB Chain $1.45 million, Polygon $0.58 million and Solana $0.25 million.

Gizmodo's ether-heavy split and Bitquery's TRON-heavy split describe the same theft at two moments. Bitquery saw 20 million USDT bridged from TRON to Ethereum in 40 equal pieces and 2,990 ETH pushed through mixers. A tracker that counts where funds sit after bridging books them as ether; one that counts the victim's chain books them as TRON. Ledger has confirmed none of these totals.

Loss estimates by tracker, in millions of dollars

Figure 02tanuki42 and Specter as reported by The Block (October 9). Gizmodo breakdown (October 9). Bitquery investigation (October 11). Yfarmx as reported by Bitcoin.com News (October 10). Ledger has confirmed no figure.

Some of the money is stuck. Bitquery's October 11 count put about $81 million still traceable on-chain, with $10 million in USDT frozen by Tether, 5.35 million USDC listed as recoverable by Circle and 203.8 BTC sitting unmoved in the drain addresses. Frozen is not returned, and no process for victims has been announced.

What is unknown, and what to watch

The open questions are the ones that decide the scope. Ledger has not said how many devices carry an implant, whether every drained wallet traces to a tampered unit, or who did it. CryptoBilis has stopped selling all hardware wallet inventory until the investigation ends, according to Ledger's update as reported by The Crypto Times, and Ledger says it is contacting affected users and working on "enhanced anti-tampering solutions".

The practical rule has not changed since the Coldcard incident in August: a device is only as trustworthy as the path it took to reach you. Our wallet security guide covers buying direct, checking the device on first boot and keeping the recovery phrase offline. Ledger's own line is the one to remember: it "will never ask for your 24-word recovery phrase".

Three things would move this story. The first is a Ledger count of implanted devices, with a statement on whether every confirmed drain traces to a CryptoBilis unit. The second is a word from CryptoBilis itself or from authorities in Malaysia, Indonesia or the Philippines. The third is whether Tether's frozen $10 million and the unmoved 203.8 BTC turn into a recovery process for victims.

Frequently asked questions

What should I do if I bought a Ledger from CryptoBilis?

Follow Ledger's October 9 instructions. If you bought in the last 90 days and have not set the device up, do not start. If you already set it up, move your assets to a new Ledger device with a newly generated recovery phrase, using only ledger.com for instructions. Never type your 24 words into any website or app, and treat any message asking for them as a scam.

Are devices bought directly from Ledger affected?

Ledger says it has no indication that its own infrastructure, systems or services were compromised, and the reports it cites concern devices bought from the reseller CryptoBilis in Indonesia, Malaysia and the Philippines. It has not published the number of implanted devices, so the safe reading is that the scope is still open.

How much was stolen?

No confirmed figure exists. On October 9, tracker tanuki42 counted more than $72 million and Specter more than $86 million. By October 11, Bitquery counted $93.2 million from 315 wallets on six chains, and Yfarmx $93.4 million across 471 addresses. The ranges differ because each tracker counts different chains and addresses at a different time.

Spotted a mistake or a stale fact? Tell us and we will fix it and say so on the page. This is information, not financial advice. How we work: editorial policy.