On October 9, 2026, Ledger began investigating wallet thefts tied to devices sold by CryptoBilis, a longtime authorized Southeast Asian reseller, and ordered the reseller to halt sales and shipments. According to Ledger's October 13 update, the attack involved a hardware implant in at least one affected device - an extra chip that intercepted the 24-word seed phrase as the device displayed it during setup, then transmitted it over a cellular radio to the attackers. The attack was discovered when someone opened a Ledger and found the spy chip, posting a photo to Twitter, with the hosts crediting former Mt. Gox CEO Mark Karpelès with the post. Once the operation was exposed, the attackers drained the wallets whose keys they had already harvested, producing the $100M+ figure.
The investigation reveals hundreds of exploited devices across reports, with an estimated $102 million stolen from 324 wallets. This represents the largest physical supply-chain attack in crypto to date, as reported by Bankless. The attack was discovered when someone opened a Ledger and found the spy chip, posting a photo to Twitter - the hosts credit Mark Karpelès, the former Mt. Gox CEO, with the post. The scale of the breach significantly exceeds earlier findings by investigator ZachXBT concerning cryptocurrency stolen from Bitget, which involved approximately 2,700 ZEC transferred into Zcash's Ironwood shielded pool, valued at roughly $3.8 million at the time.
The breach highlights critical vulnerabilities in the cryptocurrency hardware supply chain. CryptoBilis had reportedly been acquired by a Chinese-national-owned company roughly six months earlier, with the previous owners under NDA and unable to disclose the sale. The hosts note this represents another blow to self-custody usability, following Ledger's earlier customer-data breaches. Their practical takeaway is unambiguous: buy hardware wallets directly from the manufacturer, never from a reseller, authorized or not, and never used. They suggest mitigations including multisig and multiple device vendors as protective measures.
According to reports from Specter, the activity involved several threat actors using Zcash's privacy technology to conceal transaction details once assets enter a shielded pool. Zcash supports transactions that can hide information about senders, recipients and transferred amounts, with its privacy technology preventing outside observers from seeing transaction details. However, the researcher's allegations do not establish that every reported transfer was successfully concealed or that the funds have reached their final destination. Investigators can identify certain deposits into shielded pools, but the available public record does not necessarily reveal where the funds move afterward.
According to reports, Zcash activated Ironwood in July 2026, creating a new shielded pool after an Orchard vulnerability. The Zcash Ironwood network upgrade followed the discovery of a vulnerability in Orchard that could have allowed counterfeit coins to circulate without detection. Developers introduced safeguards restricting transfers from the older pool and created a replacement pool with updated cryptographic protections. The upgrade was designed to make Zcash's circulating supply independently verifiable, though it was not introduced as an anti-money-laundering mechanism.
