Ledger Hardware Implant Incident: What We Know So Far

On October 9, 2026, reports showed funds leaving hundreds of Bitcoin, Ethereum, and Tron wallets at about the same time. The Ledger devices were genuine. Ledger says its chip, operating system, and servers were not hacked.

The attackers targeted the devices after they left Ledger. They opened genuine wallets, added hidden parts, and put them back into reseller channels in Southeast Asia. Those parts captured recovery phrases during setup.

This attack exposed a gap in Ledger's Genuine Check. The check can confirm that the main chip and firmware are real. It cannot detect another part connected to the screen.

According to Ledger's October 15 report, the group spent months preparing the attack and millions of dollars carrying it out. It also built systems to collect recovery phrases, drain wallets, and move the stolen funds.

After the theft, Ledger's Donjon security team examined one of the hidden implants. Ledger also bought devices from stores, including stores in Germany, and checked samples from its warehouses. It found no implants in the devices it inspected.

How the Devices Were Changed

The first reports pointed to CryptoBilis, an authorized reseller in Malaysia and Southeast Asia. Ledger asked the company to stop all sales and shipments. It told people who had bought an unused device from CryptoBilis in the previous 90 days not to set it up. People who had already used one were advised to move their funds to a new device with a new recovery phrase.

Tom's Hardware reported that the implant included a cellular module. During setup, it could read the 24 word recovery phrase from the screen connection and send it to the attackers over LTE.

Ledger has confirmed that the implant captured recovery phrases during setup. It has not yet published the full technical report. Until then, details about the screen connection and LTE transfer come from press reports, not from Ledger's final analysis.

The Genuine Check missed the implant because it checks the main chip, not every part inside the case. The main chip and firmware were real. The added part sat beside them and watched the recovery phrase appear on screen.

How Much Was Stolen

Ledger has not confirmed how much was stolen. Public estimates changed as investigators found more wallets and followed the funds.

• On October 9, investigator Specter estimated more than $86 million across hundreds of wallets. CoinDesk said this figure had not been independently confirmed.
• On October 12, The Star cited an estimate of more than $70 million from Arkham analyst Emmett Gallic.
• By October 14, Bloomberg reporting cited by Tom's Hardware put the figure at $93 million.

These are estimates from outside investigators and news reports. Ledger has not published its own total.

What Ledger Changed

Ledger asked authorized sellers in Southeast Asia and Hong Kong to stop selling its products while the investigation continues. It also checked samples from its own stock and found no implants.

The company also tightened its rules for sellers:

• Returned devices must never be sold again, even if they look unopened.
• Devices should be stored away from customers instead of sitting on shelves or displays.
• Sellers must report unusual devices or customer complaints quickly.

Ledger says it is also working on changes to the devices themselves, but it has not shared details yet.

These changes reduce the risk, but they also show that an authorized reseller is not enough on its own. A returned device can look new and still contain extra hardware.

What Is Still Unknown

Ledger has not yet published the full implant teardown. We still do not know exactly how many devices were changed, how the attackers put them back into stores, or how they resealed the packaging.

The clean samples support Ledger's claim that this was limited to part of its reseller network. They do not tell us how many changed devices had already reached customers.

Some early reports described this as a factory attack. Ledger says the devices were genuine and were changed after leaving its control. The evidence published so far supports Ledger's version, but the full technical report is still pending.

What Users Should Know

• The recovery phrase is visible inside the device during setup. Hidden hardware connected to the screen can copy it.
• A genuine firmware check does not prove that every part inside the case is original.
• If a recovery phrase may have been copied, a software update cannot make it safe again. The user needs a new device and a new recovery phrase.
• Returned devices are a security risk, even when the box looks unopened.

Ledger CTO Charles Guillemet asked anyone with a suspicious device to contact Ledger support before opening it. Opening the device without guidance could damage the implant or destroy useful evidence.

Hardware wallets still protect users from many online attacks. This incident shows that buyers also need to trust the device, its packaging, and the path it took to reach them.

References: Ledger, October 15, Tom's Hardware, CoinDesk, The Star and Bloomberg, and Bloomingbit.