Ledger Hardware Implant: $93 Million Drained and What You Need to Know

$93 million taken from hardware wallets in a matter of days. No firmware hack. No software exploit. Every affected device passed the official authenticity check. The theft happened before the box was even opened.

This is what we know as of October 13, 2026.

What happened

On October 9th, users in Southeast Asia started reporting their wallets drained. Hundreds of them. The one thing they had in common: every wallet came from the same reseller, a company called CryptoBilis, operating in Malaysia, Indonesia, and the Philippines.

CryptoBilis was not a grey-market seller. It was an authorized Ledger reseller listed on Ledger's own distribution page, operating since 2020. Ledger told them to halt all sales and shipments on October 9th. On October 10th, Ledger confirmed it: one of the affected devices contained an unauthorized hardware implant.

Someone had physically opened these wallets and modified them before they were ever sold.

How the implant works

Ledger's own security team described the mechanism on October 13th. The implant is a small added module hidden inside the plastic casing. It has a tiny microcontroller and a mobile modem with an antenna. It sits right next to the screen and connects to the display bus.

That placement matters because of what happens during setup. When you first configure one of these devices, it shows you your 24 recovery words on screen. That moment is supposed to be the safest point of the entire process. The words never touch your phone, never go over the internet, never leave the device. They appear on the display for you to write down and that is it.

The implant reads those words directly off the screen as they appear, then transmits them over the mobile network to whoever installed it. From that point, the attacker has everything they need to drain the wallet whenever they choose.

The implant never touched the Secure Element chip. Never touched the firmware. The device would still pass Ledger's official Genuine Check inside the Ledger app. That check looks for tampering at the software and chip level. It does not scan for extra hardware installed inside the casing.

Researchers have found at least three generations of the implant. The earliest versions were identified by hardware researcher Joe Grand in August 2025 after a Reddit report. He notified Ledger in March 2026. Early versions were more obvious. Later versions use flex circuits and color-matched parts that are harder to spot. The attack became public in October 2026.

How far this has spread

Confirmed fund losses are currently tied by Ledger to CryptoBilis devices. On-chain researchers put the total somewhere between $86 million and $102 million across roughly 315 to 324 wallets, spread across TRON, Bitcoin, Ethereum, and others. Ledger has not confirmed those exact figures.

But devices with similar implants have now turned up well outside Southeast Asia.

In Germany, a customer found an implant in a Ledger device bought at MediaMarkt. He then found a second one, bought on a different day at a different MediaMarkt store, with the same modifications. MediaMarkt pulled every Ledger product from shelves and from their online store across their entire European network. That is over a thousand stores across about 11 countries. Ledger coordinated on the removal and has stated no confirmed fund losses are linked to that case yet.

There are also reports from Singapore (a device bought at Changi Airport), Amazon Japan (a China-based seller shipping from Malaysia), and other non-direct channels. The investigation is ongoing.

One detail that makes the timeline harder to pin down: Ledger's guidance covers devices bought in the last 90 days. But many of the drained wallets on-chain received funds back in June or earlier. Devices sold before that 90-day window may also have been affected. Some researchers have been finding versions of this implant since mid-2025, so this may have been running for over a year before it became visible.

What to do right now

• If you bought a Ledger from CryptoBilis and have not set it up, do not set it up
• If you already set it up and have funds on it, move them to a new device with a completely new recovery phrase right away
• If you bought from MediaMarkt, Changi Airport in Singapore, Amazon Japan through a third-party seller, or any other non-official channel, treat the device as suspect and contact Ledger Support
• Ledger has published an inspection guide for opening the device to check, though opening it can cause damage
• Never enter your recovery phrase into any website, app, or form under any circumstances
• If you need a replacement, buy directly from the manufacturer. For Ledger that means Ledger.com. For Trezor that means Trezor.io.

Trezor

Not affected. Trezor's statement as of October 13th was that there is not a single piece of evidence any Trezor device has been compromised. No tampered units reported, including none from CryptoBilis.

Trezor removed CryptoBilis from their authorized reseller list around October 12th as a precaution. They then announced on October 13th a broader cut to their reseller network. Affected partners lose authorization on January 1st, 2027. Trezor has already stopped shipping them new stock, though they can sell remaining inventory.

If you are looking at Trezor as a replacement or alternative, I have full reviews of the Trezor Safe 7 and the Trezor Safe 3.

Tangem

Also not affected by this incident, and for a reason worth understanding.

This implant reads the device screen. A Tangem card has no screen. During Tangem setup, the private key is generated inside the chip and never gets displayed anywhere. There is no moment where your recovery words appear on a display waiting to be read by something hidden inside the casing.

There is also nowhere on a card to install an implant. The attack requires a plastic enclosure with room inside for a microcontroller and a mobile modem. A card does not offer that space.

If you want more context on Tangem, here is my full Tangem wallet review.

A question worth sitting with

We spend a lot of time comparing chip certifications, secure element grades, and open source firmware. Almost nobody asks how many places inside a device there are to hide something.

A device with a screen, a battery, a circuit board, and empty space inside gives an attacker room to work. It also needs something worth watching on that screen. A card with no screen and no internal space removes both conditions.

Whether simpler really is better is a longer conversation. But this situation has made me think about it differently than I did before. Let me know what you think in the comments.