Key TakeawaysLedger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from SouthKey TakeawaysLedger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from South
Ledger Hack Explained: Hardware Implant Found in CryptoBilis-Sold Wallet as Losses Near $93 Million, and How to Protect Your Device
Key Takeaways
Ledger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from Southeast Asian reseller CryptoBilis reported drained wallets.
Onchain estimates of the losses range from more than $72 million to about $93 million. Blockchain analytics firm Bitquery counts more than 300 victim wallets, most on TRON and Bitcoin, drained within hours on October 9. Ledger has not confirmed a figure.
Ledger says it has "no indication" its own systems were compromised. The evidence points to a supply chain attack through a single official reseller covering Indonesia, Malaysia and the Philippines, which has suspended sales.
Anyone who bought a Ledger from CryptoBilis in the last 90 days should not set it up. If it is already in use, Ledger advises moving funds to a new device with a newly generated recovery phrase.
The thief is laundering through Tornado Cash, cross-chain swaps and the USDD stablecoin, while Tether has frozen about $10 million in USDT linked to the theft.
What Happened
The first warnings came from users. On October 9, Ledger owners in Southeast Asia began reporting on X and Reddit that their wallets had been emptied, and onchain investigators quickly linked the victims to devices bought through CryptoBilis, a Kuala Lumpur-based company listed on Ledger's official reseller directory for Indonesia, Malaysia and the Philippines. Researcher tanuki42 traced more than $72 million to suspected theft addresses, investigator Specter put the figure above $86 million across Bitcoin, Ethereum and TRON, and MistTrack cited almost $90 million.
The most detailed count so far comes from Bitquery, which tallies about $93.2 million taken from 315 victim wallets across six chains, led by TRON at about $70.5 million and Bitcoin at $16.8 million. Its timeline suggests careful preparation. The attacker's control addresses were funded on September 25 and ran test transactions until October 7. Then, early on October 9, the attacker added a new key to 30 TRON wallets, locking out their owners, and began draining at about 05:07 UTC, hitting five chains within 47 minutes.
Ledger Confirms a Hardware Implant
On Friday, Ledger said it was investigating and asked CryptoBilis to pause all sales and shipments. On Saturday it went further: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The company added, "We have no indication that Ledger's security infrastructure, systems or services have been compromised." Ledger says it is working with law enforcement, has thanked the SEAL 911 incident response group for its help, is contacting affected users, and is developing additional protections against physical tampering. It has not said how many devices contain implants or whether the implant explains every drained wallet.
Independent teardowns point the same way. Mark Karpelès, the former Mt. Gox CEO, reported a tiny component, about two by two millimeters, hidden near the screen of a Ledger Nano X that arrived from Malaysia in apparently intact shrink-wrap, and said "the only way to detect the implant is to open the device." Security firm Tibane Labs described a microcontroller and cellular hardware wired to the screen's data lines, consistent with a device that could read a recovery phrase as it is displayed during setup and send it out. Ledger has not confirmed that analysis. A separate claim from a buyer in Europe about a tampered device has not been verified, and observers disagree about the photos.
Why This Is a "Ledger Hack" That Did Not Hack Ledger
Searches call it the Ledger hack, but the evidence so far describes a supply chain attack: devices modified somewhere between the factory and the customer, not a flaw in Ledger's chips, firmware or servers. Binance co-founder Changpeng Zhao said the available information pointed to a supply chain attack at a single vendor and reminded users that "self-custody comes with extra responsibilities." CryptoBilis has suspended sales of its hardware wallet inventory until the investigation concludes and remains in contact with Ledger, which has made no accusation against the reseller. The incident follows the Coldcard wallet hack and the Trezor and SafePal data leaks earlier this year, and it shows that the security of a hardware wallet depends on where it came from as much as on the brand.
Where the Stolen Funds Went
The laundering began within hours. According to Bitquery, 1,254 ETH went through Tornado Cash on October 9, about 20 million USDT was bridged to Ethereum and swapped for ETH, and roughly $15 million was converted into USDD, a TRON-based stablecoin that Tether cannot freeze. Swap services including Relay, Chainflip and NEAR Intents carried more. Tether blacklisted 37 linked addresses and froze about $10 million in USDT, but as of October 10 about $16.8 million in Bitcoin sat unmoved and roughly $40.9 million was held as ETH in the thief's wallets.
What Ledger Owners Should Do Now
- Bought from CryptoBilis in the last 90 days and not set up yet: do not set it up. Ledger's words: "We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up."
- Already using a CryptoBilis device: "consider moving assets to a new Ledger signer (with new seed)," as Ledger advises, using a device bought directly or from a verified reseller.
- Any hardware wallet: reject a device that arrives with a pre-printed recovery phrase, confirm that a new phrase is generated on first start, and treat unusually low prices or unexpected shipping origins as warning signs.
- Never share your 24-word recovery phrase. Ledger "will never ask users to disclose their 24-word recovery phrase," and fake recovery services typically follow incidents like this one.
- If you were drained: save the transaction hashes, contact SEAL 911, file a police report, and notify Tether if USDT was taken.
What It Means for Traders on MEXC
Hardware wallets remain one of the safest ways to hold crypto long term, but this incident is a reminder that the chain of custody matters as much as the device. Traders who move funds between MEXC and a hardware wallet can reduce risk by buying devices only from the manufacturer or verified resellers, testing a new wallet with a small withdrawal first, and using two-factor authentication, an anti-phishing code and a withdrawal address whitelist in their MEXC security settings.
Disclaimer: This content is for educational and reference purposes only and does not constitute any investment advice. Digital asset investments carry high risk. Please evaluate carefully and assume full responsibility for your own decisions.
Market Opportunity
NEAR Price(NEAR)
$5.8268
$5.8268$5.8268
USD
NEAR (NEAR) Live Price Chart
The articles shared on this page are sourced from public platforms and are provided for reference only. They do not represent the position or views of MEXC. All rights belong to OoJae. If you believe any content infringes upon the rights of a third party, please contact [email protected] for prompt removal. MEXC does not guarantee the accuracy, completeness, or timeliness of any content and is not responsible for any actions taken based on the information provided. The content does not constitute financial, legal, or other professional advice, nor should it be interpreted as a recommendation or endorsement by MEXC. For expert insights and in-depth analysis, visit MEXC Learn.
Latest Updates on NEAR
View More
SpaceX Options Surge: Turning IPO Momentum Into a Volatility Test
SpaceX’s post-IPO rally has evolved beyond a simple first-day demand story. After pricing its shares at $135, opening near $150, and quickly surging past the $200 threshold, the market is now entering a critical testing phase. The most significant shift is the entry of derivatives: the emergence of record first-day options activity has transformed SpaceX from a standard IPO momentum play into a complex, volatility-driven price-discovery narrative. In this new regime, round-number psychological levels, dealer hedging, and implied volatility often dictate short-term price action as much as the company’s long-term aerospace ambitions.
2026/06/17
Nvidia FY2027 Q1 Earnings Review: Data Center Revenue Hits $75.2B as AI Chip Margins Hold Near 75%
Nvidia reported its fiscal 2027 first-quarter financial results on May 20, 2026, delivering an absolute powerhouse of a quarter. For the period ending April 26, 2026, the chip giant pulled in a record-shattering $81.6 billion in total revenue—marking an 85% surge year-over-year. The star of the show was once again the Data Center segment, which brought in $75.2 billion alone, jumping 92% from the same time last year. Even with massive scaling efforts, Nvidia kept its pricing power completely intact, with GAAP and non-GAAP gross margins landing at a remarkable 74.9% and 75.0%, respectively.
This update proved that global AI demand isn't just an abstract narrative; it is translating directly into high-margin revenue at an unprecedented scale. For investors checking the latest market trends, this Q1 report sets a massive baseline for Nvidia's next earnings cycle, testing whether the AI infrastructure boom can keep moving at this pace without hitting supply limits or margin fatigue.
2026/07/09
Miden USDCx Brings Private Stablecoin Payments Onchain
Miden plans to introduce USDCx alongside its zero-knowledge blockchain mainnet near the end of August 2026. The stablecoin will be issued natively by Miden through Circle’s xReserve infrastructure and supported 1:1 by USDC deposited into an xReserve smart contract.
2026/08/13
You May Also Like
HOT
Currently trending cryptocurrencies that are gaining significant market attention
Crypto Prices
The cryptocurrencies with the highest trading volume
Newly Added
Recently listed cryptocurrencies that are available for trading