Ledger Wasn't Hacked. The Box Was

If you bought a Ledger from CryptoBilis in the last 90 days: if you haven't set it up, don't. If you already have, treat it as compromised and move your funds to a new wallet with a new recovery phrase, created on a device you bought directly from the manufacturer. That is Ledger's own advice, and it applies until the investigation concludes.

On 9 October, Ledger said it was investigating reports of stolen funds from users in Southeast Asia who had bought devices from CryptoBilis, an authorised Ledger reseller in Indonesia, Malaysia and the Philippines. It told the reseller to stop all sales and shipments. A day later it confirmed the worst-case explanation: one affected customer's device contained an unauthorised hardware implant.

Estimates of the losses range from about $72 million to $93 million. One on-chain analysis counted roughly $92.9 million taken from 311 wallets across several blockchains, with around $10 million frozen by Tether. CryptoBilis has suspended sales of its entire hardware-wallet inventory while the investigation runs.

The distinction that matters

Most headlines say "Ledger hack." Ledger says its own infrastructure, systems and services show no sign of compromise, and there have been no reports involving devices bought directly from Ledger. Nobody broke Ledger's cryptography or its servers.

What was broken was the supply chain: the journey a device takes between the factory and your hands. Somewhere along that path, according to Ledger's confirmation, at least one device was opened and fitted with extra hardware before a customer ever unsealed it. It is reported to be the first confirmed case of a physical implant in a Ledger device linked to a reseller.

Why this attack works so well

A hardware wallet's security rests on one assumption you rarely think about: that the device in your hand is the device the manufacturer built. Its secure chip can keep a secret from your laptop, from malware, from a compromised website. It cannot protect you from the device itself.

The weakest moment is setup. When you create a new wallet, the device shows you your recovery words so you can write them down. If something on the board can read that screen — or the signals feeding it — it doesn't need to break any encryption. It just copies the words. From then on, the attacker can rebuild your wallet on their own hardware and wait.

What isn't confirmed yet: Ledger has not published its own technical findings or confirmed how the implant worked. The widely shared description — a component that captures the recovery phrase during setup and sends it out over a cellular connection — comes from outside researchers, including former Mt. Gox chief Mark Karpelès. It is plausible and consistent with the timing of the drains, but treat it as a leading theory rather than an established fact until Ledger publishes.

The third layer this year

We have now covered three different ways self-custody can fail without the user doing anything wrong:

• Software. A counterfeit wallet app on an official app store.
• Firmware. Coldcard seeds generated with too little randomness, drained by the thousands of bitcoin.
• Hardware. A genuine-brand device, sold by an authorised reseller, altered before it was opened.

The lesson isn't that hardware wallets are unsafe — for most people they are still the best option available. It's that "I use a hardware wallet" is not a complete answer to "are my keys safe?". Every link between the factory and your seed phrase is part of your security.

How to buy and set up a hardware wallet safely

• Buy directly from the manufacturer. Even authorised resellers add a link to the chain; in this case, that link failed. If you must use a reseller, choose one the manufacturer lists, and understand the risk you're accepting.
• Never use a device that comes with a recovery phrase already written down, or asks you to enter one you didn't create. A genuine device always generates a new phrase in front of you.
• Inspect the packaging, but don't rely on it. Tamper seals can be copied. An intact seal is a minimum, not proof.
• Be careful about which defences actually help here. After the Coldcard flaw, a BIP-39 passphrase protected people. Against a compromised device it may not, because you would type the passphrase into the same hardware. What does hold up is multisig across different brands: if one device is compromised, it still can't move funds on its own.
• Send a small test amount first, and watch it for a while before moving savings onto a new device.
• Ignore anyone who contacts you about this. Ledger has repeated that it will never ask for your 24 words, and a separate phishing campaign is circulating that is not connected to this investigation. Every hack headline produces a wave of fake "recovery" messages.

Why the response matters

Credit where it's due: Ledger announced the investigation as soon as reports came in, stopped the reseller's sales the same day, told affected buyers exactly what to do, and confirmed the implant publicly the next day rather than waiting for certainty. That's the kind of disclosure we argued for when Pocket Bitcoin was breached — fast, specific, and honest about what isn't yet known.

It doesn't undo anyone's loss. But it's the difference between a problem you can act on and one you find out about from your empty balance.

Where TokensFund fits

Nothing here is solved by a swap service, and we won't pretend otherwise. TokensFund never holds your funds — swaps go from your wallet through THORChain, Chainflip, Changee or CCE.Cash to an address you control — but we can't verify that the device holding that address is genuine. If you're moving funds off a device you no longer trust, move them first to a fresh wallet on hardware you bought directly, and swap later.

A note on risk

Nothing here is financial or security advice. This is a developing investigation; details reflect Ledger's statements and reporting as of 12 October 2026, loss estimates vary between sources, and the implant's exact mechanism has not been confirmed by Ledger. Ledger's own channels are the authoritative source for what affected users should do. Never share your recovery phrase with anyone, for any reason.