The core promise of a hardware wallet is that a user's private keys never touch any system outside their control. On October 10, 2026, Ledger confirmed that, for some buyers of a Southeast Asian reseller, that promise was broken before the box was even opened.

Ledger said at least one of its devices sold by reseller CryptoBilis contained an unauthorized hardware implant that gave attackers access to users' recovery phrases. A recovery phrase is the master key from which a wallet's private keys are derived, so whoever obtains it can reconstruct the wallets and move the funds without ever needing the physical device. Estimates put the damage at between $72 million and $93.2 million, drained from 311 to 315 wallets across multiple blockchains.

What Ledger Found

The affected devices were purchased from CryptoBilis within the last three months. According to the research findings, this is the first confirmed case of a physical implant in a Ledger device linked to a reseller.

Most of the losses landed in a single asset. Roughly $70 million of the stolen funds were held in USDT on the Tron blockchain. The remainder was spread across other networks: losses were also reported on Bitcoin, Ethereum, BNB Chain, Polygon, and Solana, which suggests the attackers simply swept whatever the compromised seed phrases unlocked.

Ledger stressed that its own systems and direct sales channels were not affected. The company also used the moment to remind resellers that returned products should never be restocked.

The Response So Far

Ledger's guidance to CryptoBilis buyers is blunt. Customers should not initialize devices they have not yet used, and they should not move assets without first generating a new seed phrase.

CryptoBilis has ceased operations pending an investigation. The reseller may also have changed ownership, a detail that will likely matter a great deal as investigators try to establish when and how the tampered units entered its stock.

Tether, meanwhile, froze approximately $10 million tied to the incident. Given that the bulk of the losses were in USDT, the issuer's ability to blacklist addresses at the token level—rendering the frozen balance untransferable—gave victims at least a partial backstop. That backstop has limits. Against estimated losses in the tens of millions, the frozen sum covers only a fraction, and assets drained on chains like Bitcoin do not come with a central party that can hit pause.

Why the Supply Chain Is the Soft Spot

CryptoBilis operated as an authorized reseller selling sealed and authentic devices across Indonesia, Malaysia, and the Philippines. Every additional pair of hands in a distribution chain is another point where a box can be opened, modified, and resealed. The CryptoBilis case turns that theoretical risk into a confirmed one, and it marks the boundary of what on-device security can promise: cryptographic protections inside a wallet cannot help if the hardware itself is altered before it reaches the buyer.

What This Means for Buyers and the Industry

For anyone holding a device bought through a reseller, the practical takeaway is to verify where it came from. Buyers of CryptoBilis in particular should follow Ledger's instructions and treat existing seed phrases as exposed.

Ledger's position is that its core products and services remain uncomprom, and the facts so far support a distinction between its own channels and a single rogue distributor.

Key things to watch include the outcome of the CryptoBilis investigation, any clarification on the possible ownership change, and whether the confirmed wallet count or loss estimates move further. Additional freezes by Tether, or the tracing of funds on other chains, would also shape how much victims ultimately recover.