Ledger has officially confirmed that the unauthorized hardware implant found in affected devices contains a microcontroller that can read 24-word recovery phrases during setup and transmit the information through an LTE connection using a provisioned eSIM. The company's Donjon security team disclosed on October 13 that the implant operates independently of the signer's normal security systems, specifically noting it does not modify the Secure Element, operating system, or cryptocurrency transactions. Ledger emphasized that the device does not alter the Ledger operating system, cryptocurrency transactions or digital signatures, but functions solely to capture sensitive information displayed during wallet initialization. The company confirmed that every fund loss it has verified in the incident involved devices purchased through CryptoBilis.
A major security breach has been discovered affecting Ledger hardware wallet users, with over $93 million drained from victim wallets since Friday morning. The latest data shows the breach has affected over 311 addresses across multiple blockchain networks, with the Tron network being the hardest hit at 276 victim addresses draining about $64.5 million. The Bitcoin addresses are the second most affected with 276 addresses losing $17.7 million, while the Ethereum ecosystem suffered $8.8 million across 55 addresses. The incident first came to light on Friday when Ledger acknowledged investigating reports of missing funds from customers who purchased devices through CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. As of October 9th, approximately $73 million of the stolen funds sits in attacker-controlled wallets across Bitcoin, Ethereum and Tron networks.
Tether has frozen $10 million in USDT tied to the Ledger exploit, marking a significant development in the ongoing investigation. According to blockchain analytics firm Bitquery, the freeze represents an important step as stablecoin issuers can block tokens linked to crime, unlike bitcoin or ether. The company traced $93.2 million linked to the Ledger exploit, finding that hackers stole mostly USDT and TRON tokens from 315 wallets across six blockchains. However, security research platform YFarmX reported a higher figure, estimating the attackers siphoned off $94.5 million from 521 addresses across seven blockchains. As of October 11th, roughly $81 million could still be traced onchain, while some funds had moved through Tornado Cash and Zcash mixing services. Latest blockchain analytics company Bitquery estimated that suspected cryptocurrency thefts connected to the investigation reached approximately $102 million across 324 wallets in its October 12 analysis.
Ledger has officially confirmed that a device linked to recent cryptocurrency thefts contained an unauthorized hardware implant, marking the first concrete evidence supporting earlier speculation of supply-chain tampering. In a statement released on October 10th, Ledger Support stated, "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The company confirmed that all known cases involve devices sold through the Southeast Asian reseller CryptoBilis, with the volume of impacted devices appearing limited according to Ledger's latest update on October 11th. Ledger emphasized that its internal systems and direct sales channels remain unaffected, with the company actively contacting affected users as part of an ongoing investigation.
Following Ledger's confirmation, CryptoBilis has suspended sales of all hardware wallet inventory until the investigation concludes. In its latest update, Ledger advised CryptoBilis customers not to initialize unused devices and told those with active wallets to move their funds to a new seed on a device obtained directly from Ledger. The company specifically warned users not to import or restore their existing recovery words into another device purchased from CryptoBilis, as the implant can capture recovery phrases displayed during setup. Ledger stated it is cooperating with relevant authorities and urged affected users to contact official Ledger Support and file complaints with local law enforcement. The company warned that scammers often attempt to exploit incidents of this type, reminding users that Ledger will never call, DM, or ask for their 24-word recovery phrase.
The Ledger incident has again raised broader industry questions regarding hardware wallet safety, particularly as millions of investors migrated their assets into self-custody following the 2022 collapse of the FTX exchange. In July 2026, a flaw in Coldcard's seed-generation firmware allowed attackers to drain an estimated $100 million to $130 million in bitcoin, according to on-chain researchers. Binance co-founder Changpeng Zhao (CZ) has alleged that the attackers "apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut," though these claims have not been independently verified. Ledger emphasized that security isn't static and this incident underscores why the company continuously reviews and strengthens its distribution and anti-tamper processes, calling for broader industry improvements in chain-of-custody practices. The company has requested information from researchers and others who may have evidence concerning the modifications, with relevant findings to be submitted to [email protected]
