Crypto news digest: Ledger confirms implant in CryptoBilis device
Ledger says a device tied to a wallet-draining incident carried an unauthorized hardware implant, with all confirmed cases traced to reseller CryptoBilis.
| Item | Detail |
|---|---|
| Company | Ledger (hardware wallets) |
| Reseller named | CryptoBilis (Indonesia, Malaysia, Philippines) |
| Incident date | Oct. 9, 2026 |
| Estimated losses | $86 million to $93 million (on-chain researchers) |
| Wallets affected | More than 300 |
| Chains involved | Bitcoin, Ethereum, Tron and others |
| Ledger-confirmed loss total | None published |
Ledger confirmed on Oct. 10 that a device linked to a recent wave of wallet drains contained an unauthorized hardware implant, the first concrete evidence for the supply-chain tampering theory that circulated after the losses surfaced. In this crypto news digest entry, the key point is the scope: the company says every confirmed case so far involves units sold through CryptoBilis, a reseller operating in Southeast Asia.
What Ledger has said
The company’s support team stated that one of the affected users’ devices held the implant and that it is contacting impacted customers. CryptoBilis has suspended sales of all of its hardware wallet inventory while the investigation runs, Ledger said.
A follow-up on Oct. 11 narrowed the claim. All confirmed cases tied to the Oct. 9 draining incident involve devices sold by the reseller, Ledger said, and its own internal systems and direct sales channels were not affected. Ledger is cooperating with authorities, according to its Sunday update.
Guidance for owners
Customers who bought through CryptoBilis were told not to initialize any unused device. Those who already set one up should move funds to a new seed on a device obtained from Ledger itself. Ledger also told distributors to source stock only from authorized channels and barred them from restocking returned units, and it reminded users that it never asks for a 24-word recovery phrase by call or direct message.
Loss estimates remain third-party
Ledger has not confirmed an official loss figure. Estimates from on-chain researchers run from $86 million to $93 million across more than 300 wallets. Those numbers come from public blockchain data rather than from the company.
A second hardware-wallet scare this year
The incident follows a July 2026 flaw in seed-generation firmware from Coldcard maker Coinkite, which on-chain researchers estimated allowed attackers to drain $100 million to $130 million in bitcoin. The two cases differ in mechanism, one a firmware flaw and the other physical tampering, but both involve self-custody setups that many holders adopted after the 2022 collapse of FTX.
Unverified claims
Speculation about how the supply chain was breached continues. Binance co-founder Changpeng Zhao alleged on X that the attackers “apparently bought the reseller” and required it to sign a nondisclosure agreement. The claim has not been independently verified, and CryptoBilis did not immediately respond to requests for comment.
Ledger said it is reviewing authorized reseller controls, advancing hardware protections and calling for broader industry improvements in chain-of-custody practices.
What to watch
Whether Ledger publishes a confirmed loss total, how the implant was installed, and whether the company offers any reimbursement are the open questions. Law enforcement involvement and the status of CryptoBilis inventory will also shape how far the problem extends.
Prepared with AI assistance from public sources and reviewed under our editorial policy. Not investment advice.