Tampered Ledger Wallets Sold by a Reseller

Ledger makes hardware wallets: small devices that hold the keys to your coins. By 9 October 2026, buyers in Southeast Asia began reporting that money had disappeared from their wallets. The same day, Ledger opened an investigation and asked CryptoBilis, a reseller in the region, to stop selling and shipping its devices [3].

The investigation is still going on, so details may change. This note covers reports up to 23 October 2026.

What happened

On 10 October, Ledger confirmed that “one of the impacted users’ devices contained an unauthorized hardware implant”. A day later, it said every confirmed case involved a device sold by CryptoBilis [2].

Researchers who opened the altered devices describe the implant. Extra chips and a mobile connection (an eSIM, the SIM card built into phones) were hidden inside the case. When a new owner set up the wallet, the device showed 24 recovery words on its screen. These words are the seed phrase: anyone who has them can take all the coins. The implant read the words off the screen and sent them to the attackers over the mobile network. One visible sign is an extra antenna wire inside the case [3].

In a post on 15 October, Ledger gave its account. A criminal group bought real Ledger devices, opened them, added hidden parts and put them back on sale through resellers in Southeast Asia. The group also ran its own servers to collect the words and move the money. Ledger calls this “a localized distribution attack” and says it was not a systemic supply chain attack: its chip, its operating system and its servers, Ledger says, were not hacked. Devices it checked from shops, including in Germany, and from its warehouses were clean [1].

Ledger asked its authorized resellers to pause sales in Southeast Asia and Hong Kong, never resell returned devices and keep devices off the shelves [1]. It says it is working with the police, will publish more details later and plans changes to its products [1].

Ledger has not given a figure for the losses. Outside analysts who traced the payments on the blockchain estimate roughly $86–93 million [2]. Tether, the company behind the USDT coin, froze about $10 million in USDT [5].

Some claims are not confirmed by Ledger. Mark Karpelès, the former head of the Mt. Gox exchange, said on 13 October that a Ledger Flex he bought at Changi Airport in Singapore contained a spy module, and a researcher reported similar changes in wallets bought in European shops [5]. Ledger has not linked these to the CryptoBilis case, and its 15 October post does not mention them.

What to do when buying any hardware wallet

Ledger’s advice for CryptoBilis devices: if you have not set one up yet, don’t. If you already did, move your coins to a new seed phrase created on a device you got from Ledger itself. Ledger says it never calls you or asks for your 24 words, and that you should not buy from sellers it has not authorized [2] [3].

The same habits apply to any hardware wallet, whatever the brand:

• Buy from the maker’s own shop or from a seller on the maker’s official reseller list.
• Treat a very low price on a “new” device as a warning. Researchers saw altered devices sold for about half the normal price [3].
• Set up the device yourself. Never use recovery words that came in the box, and never tell your words to anyone.
• If the seal is broken or the case looks opened, do not use the device.

A seal and an app check do not catch everything. Ledger’s Genuine Check confirms that the device has a genuine Ledger secure element, the protected chip that stores the keys. Ledger’s support page says this chip cannot detect unauthorized physical changes, such as a built-in spy device, if the original chip is left intact [4]. So an altered device can still pass the check [3]. If you hold your own keys (self-custody), where the device came from matters as much as the device.

What our BitBox02 review says

Our BitBox02 review describes what that device checks. BitBox gives each device an attestation key at the factory, and its app checks it at every connection, a form of hardware attestation. The chips are covered in epoxy, the case is glued so that opening it breaks plastic pins, and the device arrives in a vacuum-sealed bag with a patterned seal.

BitBox itself says these checks cannot prove that a genuine device was never physically changed. That is why it tells buyers to set up the wallet themselves and never use recovery words that came with the device. Other wallets are in our crypto wallets section.