Hardware wallet maker Ledger says the $86M+ theft from hundreds of its wallets involved devices sold by reseller CryptoBilis and confirms a “hardware implant”

A spy implant in some Ledger crypto wallets may be the root of an $86 million supply chain attack.

The Verge 2026-10-12 Terrence O'Brien

Context & Ripple Effects

Ledger’s prior security incidents have involved both product and operational trust: a 2018 challenge to its “tamper-proof” wallet claims, customer-data exposure in 2020 and 2021, and the 2023 Connect Kit code-insertion exploit. Those episodes made device ownership, personal-data handling and software integrations separate attack surfaces.

The confirmed implant ties the latest losses to the physical distribution path for devices sold through CryptoBilis. It raises a more basic question than a compromised app or account: whether an authorized retail channel can preserve the integrity of a wallet before its owner ever sets it up.

First-order effects

Ledger and CryptoBilis face an immediate provenance investigation into the affected devices, because the confirmed implant makes the reseller path central to identifying impacted customers and stock.
Wallet owners who bought through CryptoBilis have a concrete reason to treat the device itself—not only its software or recovery phrase—as a potential point of compromise.

Second-order effects

Authorized wallet resellers and Ledger’s other distribution partners face pressure to demonstrate custody and tamper controls, while competitors can differentiate on how they authenticate hardware between factory and buyer.
The incident makes physical inspection and supply-chain verification more consequential for wallet buyers, adding friction to a category whose value proposition depends on trusted offline key storage.

Third-order effects

If physical tampering through resale channels proves repeatable, hardware-wallet security will be judged as an end-to-end chain-of-custody problem rather than solely a secure-chip or firmware problem.
The category’s trust boundary shifts from the device at setup to every intermediary that handles it, favoring vendors and channels able to make provenance verifiable.

The trend: Crypto wallet security is broadening from protecting private keys and software to proving the integrity of the physical device supply chain.

Discussion

@ledger_support @ledger_support on x
Situation Update: Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to Ledger'…
@1ddenis1 Denis on x
@Ledger_Support Isn't this your responsibility since they were official authorized reseller from you? You bear that responsibility to compensate victims
@papajultango @papajultango on x
I have an idea that might help. When the ledger and electronic components are fully assembled but before placing them in their enclosures, dip them in thick red die to create a tamper visible proof barrier and then overmold them in clear resin so there is no access to the solderi…
@magicaltux @magicaltux on x
I have confirmed too from pictures sent to me by affected users. If you are one of the affected users and willing to donate your device to science, please DM me. https://x.com/... [embedded post]
@yfarmx @yfarmx on x
We've sent @Ledger a list of 450+ wallets drained in the CryptoBilis theft, with every transaction, to help them reach victims. …
@katexbt @katexbt on x
@Ledger_Support Which CryptoBilis are you in communication with? The old one that sold its business or the new DPRK one?
@xentele @xentele on x
@Ledger_Support are you going to compensate users for lost funds?
@joshhh_yt Josh on x
@Ledger_Support This just demonstrates that the reseller business should be discontinued - resellers cannot be trusted to handle hardware like this. And also goes without saying - anyone who cares about their funds should never buy anywhere but direct.
@bitcoinnewscom @bitcoinnewscom on x
LEDGER CONFIRMS HARDWARE IMPLANT IN SUPPLY CHAIN ATTACK Ledger has confirmed that at least …
@alsayadii Ahmed on x
@Ledger_Support stop forcing users to update software, let it optional
@ripplesinwales @ripplesinwales on x
Ledger nightmare continues. Makes me think the PTB is trying to bring them to thier knees. [embedded post]
@alohadajosh Joshua on x
@Ledger_Support That loser who sold the company is definitely in on this scam.
@stephanlivera Stephan Livera on x
Unauthorized hardware implant confirmed by Ledger [embedded post]
@byzgeneral @byzgeneral on x
Ngl, I don't understand why you would ever buy crypto hardware from a reseller. That seems insane. [embedded post]
@satsklepter @satsklepter on x
how sure are u that this only applies to this particular reseller? did u confirm with multiple victims and nobody is outside of this reseller ? what measures are u taking going forward so supply chain attacks are not possible at all? an attack could happen at multiple points duri…
@lunaticoin @lunaticoin on x
Ledger confirma los dispositivos con implantes no autorizados. Sigue la investigación [embedded post]
@thebitcointrain @thebitcointrain on x
@Ledger_Support @natbrunell I warned about this back in August and you guys brushed it off:
@star86above @star86above on bluesky
“Crypto security” is an interesting concept, but does not seem feasible for a tech sector that eschews safeguards, guardrails or government regulations. [embedded post]
@lelonstoldt Lelon Stoldt on bluesky
I've never understood the point of these wallets. The whole point of crypto is your money isn't tied to something physical. [embedded post]
@ledger @ledger on x
72 hour update on reseller CryptoBilis incident 🔽 As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users. To…
@xrplf @xrplf on x
The recent XRP Ledger security fix raised a lot of questions and some misconceptions. Let's clear them up. 1. Was any XRP created? No. XRP's supply was fixed at 100 billion when the XRP Ledger launched, and no transaction is allowed to create more. This bug was a way around that …
@valerioshi Val on x
insane that Ledger is trying to downplay this by stating that it's limited to a single reseller, when we have plenty of proof otherwise @Ledger , you don't retain trust by lying to people. quit trying to do brand damage control and instead focus on accurate reporting and what you…
@lostsol @lostsol on x
State of self-custody mode on a Sunday evening I bought directly from Ledger, funds are safe (for now), but a bad feeling remains Only buy from Ledger directly and only trust official channels (fake support DMs are coming) 🔒 [image] [embedded post]
@heytaizen Tai Zen on x
“The volume of impacted devices is limited.” This is NOT a very inaccurate statement! We have 4 tampered devices out of 400 students in SE Asia with total losses >$2M USD so u can not tell me that is “limited”. 4 tampered devices out of ~400 students is a very big sample size [em…
@_rossstephenson @_rossstephenson on x
I use @Ledger as my cold wallet too and I bought and use cold wallets from @cryptobilis as well. …
@trader1sz @trader1sz on x
I'm convinced all these non stop hack incidents lately are being purposely manufactured to eventually lead to custody of your crypto with banks It's getting more regular now which means the ‘bank custody’ announcements may be around the corner. Soon you will be convinced that the…
@benyorke Ben Yorke on x
Wow, Ledger is still scapegoating this as a CryptoBilis incident In a regulated industry …
@bicarakrypto Asyraf on x
Here are 5 main points from @Ledger 's update: 1. Only devices bought from the Southeast Asia reseller @cryptobilis were affected. …
@trader1sz @trader1sz on x
If you're still using @Ledger after the 73774748384749494th incident, then that's on you and it's just natural selection at this point [embedded post]
@chrisjourdan Captain Zwingli on x
wild thought: why doesn't Ledger, and all the hardware wallet manufacturers, use blockchain to authenticate devices and create a transparent and secure supply chain? [embedded post]

Chronicles