Ledger confirmed on Saturday, Oct. 10, that a hardware wallet belonging to one affected customer contained an unauthorized hardware implant. The company said the discovery came as it investigated reports of stolen cryptocurrency linked to CryptoBilis, a Southeast Asian reseller of its devices. It was the first time Ledger confirmed physical tampering with an affected device. The case involves devices distributed through a third-party reseller channel.

The company said "one of the impacted users' devices contained an unauthorized hardware implant." It added that it has "no indication that Ledger's security infrastructure, systems or services have been compromised." Ledger's support account said it is contacting impacted users and working with authorities. The confirmation carried weight because a hardware wallet's core protection is its recovery phrase — the word sequence generated at setup that, on its own, can restore access to a user's funds without the device.

Estimates compiled by independent on-chain analysts and investigators place suspected losses between roughly $72 million and $93.4 million.

The disclosure followed a public warning from Binance founder Changpeng "CZ" Zhao, who cautioned hardware wallet buyers a day earlier:

⚠️ Beware if you use a Ledger hardware wallet, especially if you bought one recently. Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers. Ledger is one of the most…

— CZ 🔶 BNB (@cz_binance) October 9, 2026

What Investigators Found

On-chain analyst Yfarmx put suspected losses at $93.4 million across 471 addresses. Bitquery estimated about $92.9 million 311 addresses, and researcher Specter said losses topped $86 million. On-chain investigator tanuki42 identified more than $72 million sent to addresses believed to be tied to the thefts. Ledger has not confirmed any of these numbers, and investigators have not established a final count of affected wallets.

Former Mt. Gox CEO Mark Karpelès published findings on a modified Ledger Nano X. He described a hidden circuit board and cellular equipment capable of intercepting recovery phrases. According to those findings, the equipment monitored data sent to the device's screen during setup and could then transmit the recovery words over a cellular link. The mechanism struck at the moment hardware wallets are meant to protect: setup, when the secret phrase is created and the device is the only place it exists. Investigators have not shown that every affected wallet contained similar parts, and no final tally of tampered devices exists.

Reseller Pauses Sales and Shipments

CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines, has stopped selling hardware wallets until the investigation concludes. Ledger asked the reseller to pause sales and shipments on Oct. 9. The pause has drawn attention to the reseller layer of the hardware wallet market, where devices pass through third-party distribution before reaching buyers.

The company told customers who bought a device from the reseller within the past 90 days not to set it up. Those who had already done so were advised to move their assets to a new Ledger signer with a new seed. A new seed replaces the recovery phrase generated during the original setup.

Ledger said it is working on stronger anti-tampering tools and thanked the volunteer security collective SEAL 911 for helping investigators.

On X, some users asked whether Ledger will refund victims. Others argued the company should take responsibility because CryptoBilis was an authorized reseller. Ledger has not announced any compensation.

Fake Ledger Website Appears in Google Search

Separately, researcher Cyber Scrilla warned that a fake Ledger website and app appeared near the top of Google search results, as highlighted in a Bitcoin News report. The operators reportedly tried to get visitors to enter their 24-word recovery phrases.

FAKE LEDGER WEBSITE APPEARS AT TOP OF GOOGLE SEARCH AMID $86M WALLET THEFT INVESTIGATION

Security researcher @cyberscrilla has flagged a fraudulent Ledger website and app appearing prominently in Google Search, designed to trick users into revealing their 24-word recovery…

— Bitcoin News (@BitcoinNewsCom) October 10, 2026

Reports said the site showed more than 1 million visits over 30 days, a figure that has not been confirmed. No victim count or amount stolen has been established for the site, and how many users may have been exposed remains unknown.

A September report from security firm Zscaler described a similar scheme using fraudulent Google ads. The firm found that the claim of 1 million visits appeared to refer to google.com, not the phishing page, suggesting the traffic figure may have been misattributed.

Researchers have not shown that the phishing sites caused the CryptoBilis losses. The two are separate issues, though both involve Ledger users.

Guidance for Ledger Users

Ledger says users should never type a recovery phrase into a website, app, or online, and that it will never ask customers for their 24-word recovery phrase. It advises downloading software only from the official Ledger website and checking web addresses closely.

The most recent update came Oct. 10, when Ledger said one confirmed device contained an implant. The number of other tampered devices and the people responsible remain unknown. Whether investigators establish a final count of tampered devices, whether Ledger announces any compensation, and when CryptoBilis resumes sales are the open threads to follow as the probe continues.

Source: CoinCentral