Science & Tech · Cybersecurity · 1 hr ago
Ledger Signer Implant Linked to at Least $86 Million in Crypto Theft
A hidden implant in some Ledger signers was linked to cryptocurrency theft from multiple users.
The devices were sold through CryptoBilis, a reseller in Southeast Asia.
Ledger signers are offline devices used to approve cryptocurrency transactions.
The implant read users’ 24-word recovery phrases during setup and sent them to attackers over LTE.
Ledger said the implant did not alter the device’s software, transactions or signatures.
An on-chain investigator estimates the losses may exceed $86 million, while Ledger says it has not confirmed the total or the number of affected users.
Ledger asked CryptoBilis to stop selling the devices and told customers to stop using them.
Customers who set up a device from the reseller were advised to consider moving their assets to a new signer with a new recovery phrase.
An unauthorized hardware implant in Ledger signers sold through Southeast Asia reseller CryptoBilis has been linked to at least $86 million in cryptocurrency theft.
The implant could read recovery phrases displayed during device setup and transmit them to attackers over LTE.
Ledger said all confirmed fund losses linked to the incident involved a signer sold through CryptoBilis.
On-chain investigator Specter said the total losses may top $86 million, while Ledger said it had not confirmed the total stolen or the number of impacted users.
Ledger told the reseller to stop selling its devices and advised customers to stop using them.
- Who
- Users of Ledger signers sold through CryptoBilis lost cryptocurrency; the attackers’ identities are not stated.
- What
- A hardware implant was linked to cryptocurrency theft of at least $86 million.
- When
- The theft was disclosed on October 9, 2026. Ledger confirmed the link to CryptoBilis devices on October 13.
- Where
- The signers were sold through Southeast Asia reseller CryptoBilis. The location of the theft is not stated.
- Why
- The implant intercepted recovery phrases displayed during setup and sent them to attackers.
On-chain investigator Specter
Ledger
Total losses
On-chain investigator Specter
Specter said losses associated with the supply chain attack may top $86 million.
Ledger
Ledger said it had not confirmed the total stolen.
The cryptocurrency theft was disclosed and immediately linked to devices sold through CryptoBilis.
Ledger confirmed that all confirmed fund losses linked to the incident involved a signer sold through CryptoBilis.
- Estimated losses
- At least $86 million
- Reseller
- CryptoBilis
- Recovery phrase
- 24 words
- Transmission method
- LTE using a provisioned eSIM
- Disclosure date
- October 9, 2026
What people are saying
We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed),
The implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM,
Posts on X
Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to
Update from Ledger Donjon on the CryptoBilis investigation 🔽 @DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer.
There have been a reports on X and Reddit of wallet-draining by Ledger users. I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin. Total losses $86M+
Sources
Related news
Cyberattack overheats refrigeration systems in hundreds of French supermarkets
Cyberattack disrupts systems at TFG’s three UK fashion brands
GitLab urges self-managed users to patch critical code execution flaw
Cyberattack Defrosts Refrigerators at Hundreds of French Supermarkets
Up to 6.5 million customer records may be exposed in Japan sushi cyberattack
Ahold Delhaize takes some systems offline after cyberattack
Mozilla launches Firefox Enterprise to help companies control browser AI use
Weak password claims surface in Denmark breach affecting 8.8 million people
XWorm malware adds tools for tracking, listening and browser control
Scammers use fake Marketplace listings to prompt text replies
LG Fixes WebOS Flaw That Could Give Local Network Attackers Root Access
