A supply-chain attack hitting Ledger hardware wallets has been traced to devices sold by Southeast Asian reseller CryptoBilis, with total losses reported at more than $86 million and possibly above $93 million.
On Oct. 9, 2026, on-chain investigator Specter noticed a tight cluster of theft reports from Ledger users on X and Reddit. The report said the funds were gathered from several chains, including Bitcoin, Ethereum and TRON.
Ledger later said all verified cases led back to hardware sold by CryptoBilis. Investigators also discovered an unauthorized hardware implant inside one affected device. So this was not a software exploit, not phishing, and not user error. It was a physical-layer supply-chain compromise.
The seed phrase was captured from the screen, not extracted from the secure element
The report said the attackers did not attempt to break Ledger’s secure element. They went after the display path used during wallet setup, the moment the 24-word recovery phrase shows up on screen.
According to the article, former Mt. Gox CEO Mark Karpelès opened a sealed device and found a small module tucked under the screen padding. It reportedly contained a microcontroller connected to the display’s SPI data line, an LTE module with eSIM support, and an antenna.
The attack chain was laid out in six steps:
- The seed phrase is generated normally inside the secure element.
- The device displays the phrase on screen for the user to write down.
- A malicious module taps the display data line and captures the screen output in real time.
- All 24 words are recorded.
- The phrase is transmitted to the attacker over LTE or eSIM connectivity.
- The attacker uses the phrase to drain the wallet.
Put simply, the private key never left the device. But the recovery phrase was exposed during the few seconds it appeared on screen.
Why authenticity checks still passed
One of the article’s main findings is that Ledger’s authenticity check could still pass on a compromised device. The secure element was genuine. The signatures were genuine. The seed phrase generation process was genuine. The implant merely listened during screen refresh events and did not touch the secure element’s internal data path.
That meant the device could look authentic at the digital level while already being compromised at the physical level. And that was the weak spot exposed here: a secure element can block direct private-key extraction, but it cannot stop a display-side implant from copying what the user sees.
The implant reportedly evolved through three generations
The article said this tampering was not some one-off hand-built tweak. It described a three-generation design path.
First generation: visible hand-soldered wiring
The earliest version used hand-soldered jumper wires attached straight to the original circuit. To create room for the added parts, the battery was replaced with a smaller, lower-capacity unit.
The image caption credited Tibane Labs as the source.
Second generation: flexible PCB design
The second version swapped out much of the visible wiring for a thin flexible board, making assembly easier and cleaner. The battery still had to be replaced with a smaller one to open up internal space.
This image was also credited to Tibane Labs in the article.
Third generation: closest to factory appearance
The third version was described as the hardest to catch. The original battery, mainboard and buttons stayed in place, making the device look almost identical to a standard Nano X. The visible clue mentioned in the report was a thin black antenna line along the top edge of the case.
The image caption credited Mark Karpelès. The article said this design strongly pointed to a batch-oriented operation backed by research, iteration and supply-chain coordination.
Where the stolen funds went
The report said the recovery window shrinks fast once the funds start moving. Bitquery estimated total stolen assets at about $93.2 million across 315 wallets on six chains.
It said about 2,990 ETH moved through Tornado Cash and, after withdrawal, flowed into a Zcash privacy pool. Tether froze about $10 million in related USDT. The attackers then swapped some USDT into USDD, a stablecoin on TRON.
Bitquery’s tracing map, as described in the article, showed victim funds split into multiple transfers, routed to several hacker-controlled addresses, and then sent through instant swap services such as ChangeNOW and FixedFloat. The amounts were broken up on purpose to dodge risk controls. The article summed up the laundering route like this: collect first, split next, mix later.
It also stressed that frozen USDT does not mean recovered funds. Freezing only stops further movement. Any return of assets would still need investigation, verification and law-enforcement coordination. The article added that about 700 ETH remained untouched in the original addresses.
How users can inspect their Ledger devices
The report advised Ledger users, especially people who bought through third-party channels, to check software verification, setup behavior and physical signs.
Software verification is useful, but not enough
Users can connect the device to Ledger Wallet and run the authenticity check in the “My Ledger” section. A legitimate device can prove itself cryptographically to Ledger’s servers.
But the article made the point plainly: passing that check does not prove the device was not tampered with at the physical layer.
Ledger’s guidance, as quoted in the article, said users who bought a device from CryptoBilis in the past 90 days should not initialize it if it is still unopened. If it has already been set up, they should consider moving assets to a new Ledger signer with a new recovery phrase.
The article said users should stop immediately if they run into any of the following during setup:
- The device arrives already initialized, with a preset PIN or an existing wallet.
- The package includes a printed or handwritten recovery phrase card.
- Any website, QR code or paper insert asks the user to enter or use a provided seed phrase.
Physical checks differ by model
The article warned that opening a device can void the warranty and may damage the board through static electricity.
For models that can be opened, including the Nano X, the report said genuine units should use an STM32WB35 chip and should not contain extra chips on the board. Any additional module, wire or chip under the screen padding should be treated as a red flag.
For non-openable models such as Ledger Stax, Flex and Nano Gen5, users were told to inspect the case edges for cracks, cuts or unusual gaps. The report also warned against putting too much faith in intact outer packaging, saying even devices with perfect shrink-wrap could still have been altered.
Advanced verification for technical users
Technical users can run secure-element proof verification with the ledgerblue tool. The article said this only confirms whether the secure element is authentic. It does not detect a screen-layer hardware implant.
What Ledger users were told to do now
The article set out a priority order for users who bought from CryptoBilis or could not confirm where their device came from.
Already set up and holding assets: move funds
It quoted Ledger as saying: “If you have already set up your Ledger device, consider transferring your assets to a new Ledger signer using a new recovery phrase.”
The practical message was simple: use a new signer and a new seed phrase. Do not reuse the original 24 words from the old device.
The report listed three specific migration steps:
- The replacement device must use a brand-new recovery phrase.
- It is better to buy the new device directly from Ledger’s official website rather than through any third-party seller.
- Once migration is complete, the old device should no longer be used for any asset-related action.
Not initialized yet: do not set it up
If the device has not been initialized, the article said it should stay powered off, disconnected and unused. CryptoBilis has suspended all sales and shipments of hardware wallet inventory while the investigation continues.
Bought from other resellers: stay alert
The article quoted Darkfost as saying the community had also mentioned other possibly related reseller names, including some Lazada merchants. It presented that as speculation, but said the risk window still called for caution.
Ledger also warned resellers to source devices only through authorized channels and not relist returned products. It advised users not to buy from unauthorized sellers, saying suspicious, counterfeit or modified devices carry high risk and do not operate under Ledger’s security standards.
The article also cited CZ, who suggested waiting a few weeks after buying a hardware wallet before moving large amounts into it. That delay, as the report framed it, gives the market time to spot a first wave of thefts if a batch was tampered with before reaching resellers.
Scammers are already using the incident
The article warned that secondary scams often follow a real attack. It said an impersonation account, “Ledger. Notify” (@NotifyLedger), had already spread a false warning claiming 410,000 devices were at risk and directed users to phishing links such as incident-ledger.com.
Users were told to trust only @Ledger and @Ledger_Support. Ledger, the report said, will not proactively ask for a seed phrase or require users to “verify security” through unofficial links.
Status of the case
As of Oct. 12, Ledger was still contacting affected users, and CryptoBilis had stopped both sales and shipments, according to the article. Ledger’s stated review window covered the past 90 days. Anyone who bought from that reseller during that period, whether the device had been initialized or not, was advised to reassess asset security.
The report’s core point was not that Ledger’s secure element had been broken. It was that a hardware wallet’s security boundary extends beyond the chip and firmware. A private key can stay inside the device while the recovery phrase is still captured the instant it appears on screen. And a device can pass software checks while already being compromised before the box is opened.