Hidden Chip Found in Ledger Wallet as Crypto Theft Losses Top $86 Million

TLDR

• Ledger confirmed an unauthorized hardware implant inside one customer’s wallet bought from reseller CryptoBilis.
• Investigators estimate losses may exceed $86 million across Bitcoin, Ethereum and Tron.
• CryptoBilis stopped selling all hardware wallets until the investigation ends.
• Ledger told affected buyers not to set up their devices and to use a new recovery phrase.
• Ledger has not confirmed the loss figures or that the implant caused the thefts.

---

Ledger has confirmed that one customer’s hardware wallet contained an unauthorized hardware implant. The company found it during an investigation into crypto thefts tied to a Southeast Asian reseller.

Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to…

— Ledger Support (@Ledger_Support) October 10, 2026

The reseller is CryptoBilis, which sells in Indonesia, Malaysia and the Philippines. Reports of unauthorized transactions began on October 9.

Ledger said it is contacting affected users and working with law enforcement. It has not said how many wallets were modified.

What Ledger Found

Ledger did not name the device model or say how the part was installed. It also has not said whether the implant sent out any data.

What’s crazier is the hackers apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut.

So many things wrong here… https://t.co/pJAZmvJNnb

— CZ 🔶 BNB (@cz_binance) October 11, 2026

The company said it has no sign that its own systems or services were compromised. It described the problem as isolated to one reseller and its market.

Researcher Mark Karpelès reported finding extra electronics behind the screen of a Ledger Nano X from Malaysia. The packaging looked intact.

Tibane Labs described a microcontroller and cellular hardware linked to the screen’s data lines. Researchers said such a part could capture recovery words shown during setup.

Ledger has not confirmed that the implant caused the thefts. It has confirmed only physical tampering in one device.

CryptoBilis stopped selling all hardware wallets until the investigation ends. Ledger said it is in contact with the reseller about next steps.

Ledger told customers who bought from CryptoBilis not to set up their devices. Those who already did should move funds to a new wallet with a new recovery phrase.

Estimated Losses

Investigator Specter estimated losses may exceed $86 million across Bitcoin, Ethereum and Tron. An earlier report put suspected thefts above $72 million.

Bitquery estimated that $92.9 million left 311 wallets across Bitcoin, Ethereum, Tron, BNB Chain and Polygon. About $70.5 million came from Tron wallets and $16.8 million was Bitcoin.

Bitquery said about $10 million in USDT has been frozen. It also traced some funds to Tornado Cash, a service that hides transaction history.

PublicAML reported that about 900 ETH reached Tornado Cash on October 10. Ledger has not confirmed any of these loss figures.

Former CryptoBilis executives said they handed over control of the business in March after an ownership change. Their statement does not say who modified the device.

Ledger asked anyone with information to contact its bounty program at bounty@ledger.fr. It also warned that its support staff will never ask for a 24-word recovery phrase.

Ledger said on Saturday it is still contacting users. It has not named suspects, announced arrests or given a date for finishing the investigation.