Ledger, the maker of one of the world's most popular cryptocurrency hardware wallets, confirmed on Saturday, Oct. 10, 2026, that a customer's device contained an unauthorized hardware implant — the first time the company has acknowledged physical tampering in an investigation it opened the day before.
The investigation began after reports of drained wallets among customers in Southeast Asia who had purchased Ledger devices through a third-party reseller called CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. Ledger asked the reseller to pause all sales and shipments on Oct. 9. The company also said it has no indication that its own systems or services were compromised.
On-chain investigators have offered widely varying estimates of the thefts — one researcher put suspected losses above $86 million, while other analyses ranged from about $72 million to more than $93 million across several hundred wallets. Ledger has not confirmed any of these figures, and the exact number of affected devices remains unknown.
Separately, security researcher Cyber Scrilla warned on Oct. 10 that a fake Ledger website appeared near the top of Google search results, trying to trick visitors into typing in their 24-word recovery phrases. The phishing site is a separate issue from the reseller case. Ledger says it will never ask for a recovery phrase.
What Ledger advises: If you bought a Ledger device from CryptoBilis in the past 90 days, do not set it up. If you already did, move your assets to a new wallet with a freshly generated seed phrase. Buy hardware wallets only directly from the manufacturer, download wallet software only from the official Ledger site, check web addresses closely, and never type your recovery phrase into any website, app, or online form.
Why it matters: Hardware wallets are considered the safest way to store cryptocurrency because the private keys never leave the device — this incident shows the supply chain itself can be the weak link. A tampered device can look and act genuine while quietly capturing your recovery words during setup. For anyone who holds crypto or has helped family members set one up, the rule is simple: buy direct, guard your seed phrase, and treat any request for it — website, call, or app — as a scam. This is a developing story; Ledger says it is working with authorities and developing stronger anti-tampering tools.
