Science & Tech · Cybersecurity · 2 hrs ago
Ledger confirms a tampered wallet device in crypto theft investigation
Ledger, a maker of hardware wallets used to store cryptocurrency, is investigating reports of stolen funds.
It confirmed that one affected device contained an unauthorized hardware implant.
Ledger says all confirmed cases so far involve devices sold through CryptoBilis, a reseller in Southeast Asia.
Estimates cited in the coverage put the total stolen at least at $86 million, with one calculation suggesting it could exceed $100 million.
The implant may have been fitted behind the screen and could capture information displayed there, according to the coverage.
CryptoBilis has stopped selling the wallets while the investigation continues, and Ledger says it is working with authorities.
Ledger advises buyers who have not set up their devices not to initialize them, and those who have should move their funds to a new seed on another device.
Ledger confirmed that one device involved in a reported cryptocurrency theft contained an unauthorised hardware implant.
The company said all confirmed cases in the incident involved devices sold through Southeast Asian reseller CryptoBilis.
Ledger said CryptoBilis had stopped selling the wallets while the investigation continues.
PC Gamer reported estimates that at least $86 million had been stolen, with YFarmX calculating the total could exceed $100 million.
Ledger said it was working with authorities and reaching out to affected users.
- Who
- Ledger, its reseller CryptoBilis and users whose devices were affected.
- What
- Ledger confirmed that one impacted device contained an unauthorised hardware implant linked to a reported crypto-draining incident.
- When
- The reported draining incident was dated Oct. 9, 2026; Ledger issued a 72-hour update.
- Where
- Confirmed devices were sold through CryptoBilis, a Southeast Asia reseller.
- Why
- Not stated
This story does not have two clearly opposing sides.
one of the impacted users' devices contained an unauthorised hardware implant.
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis.
The volume of impacted devices is limited.
The date of the disclosed draining incident cited by Ledger.
Ledger said it was continuing its investigation, working with relevant authorities and contacting affected users.
- Confirmed implant
- One impacted user’s device contained an unauthorised hardware implant.
- Reseller
- CryptoBilis, described as a Southeast Asia reseller.
- Incident date
- Oct. 9, 2026.
- Sales status
- CryptoBilis said it had ceased wallet sales pending the investigation.
- Reported losses
- At least $86 million; YFarmX’s calculation suggested the total could exceed $100 million.
Sources
Related news
Cyberattack defrosts refrigerators at French supermarket chains
Ledger confirms tampered wallets linked to CryptoBilis fund thefts
Malware incident at contractor may expose 8.7 million karaoke records
Critical SonicWall flaw faces exploitation days after patch
Cyberattack disrupts refrigeration systems at French supermarkets
Albert Heijn systems remain offline after cybersecurity incident
Canadian cybersecurity executive arrested on federal extortion charges
Attacks disrupt Yandex services and its data centers in Russia
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Cyberattacks disrupt French supermarket freezers and Dutch-Belgian retail operations
Exposure management shifts cybersecurity focus from controls to risk
