Explained: The Ledger Supply Chain Incident (October 2026)

What it is

In October 2026, Ledger hardware wallets sold by CryptoBilis, a Ledger reseller in Southeast Asia, carried an implant that stole recovery phrases. On-chain analysis estimates $93 million was stolen. Users began reporting vanishing funds on 9 October 2026, and Ledger then confirmed an unauthorized implant in at least one CryptoBilis device.

How it works

The implant watched the device screen during setup and captured the 24-word recovery phrase. An eSIM let it send the phrase to the attacker over LTE. It did not touch the Secure Element or the transaction and signing logic. The loss came from the phrase itself: it regenerates the root key, so the attacker could derive every private key the device held.

Preconditions / Affected

• Devices bought from CryptoBilis are the only ones Ledger has tied to confirmed losses.
• The exposure happens at initialization, when the phrase is shown on screen. Per Ledger's guidance, a CryptoBilis device that was never initialized has not yet leaked a phrase.

What to do

• Do not initialize any unused CryptoBilis device.
• If funds sit on a CryptoBilis wallet, move them to a new device with a fresh recovery phrase. Reusing the old phrase keeps the exposure.
• The page's lesson is to buy directly from the manufacturer, which limits how many parties handle a security-critical device.
• Ledger asked resellers in seven Asian markets to suspend sales and pull stock.

Caveats

• On 13 October 2026, Mark Karpelès, former Mt. Gox CEO, publicly confirmed that a Ledger Flex bought at Singapore's Changi Airport from retailer Metapod held a spy module. Ledger has not publicly linked this to the CryptoBilis cases.
• A researcher reported similar modifications in wallets from MediaMarkt stores in Europe. The store records they shared name a European distributor as the inventory source, but they do not show that the distributor supplied those wallets or took part in tampering. No link is proven.
• Tether froze about $10 million USDT, a small part of the estimated total.
• The page does not say how to detect an implanted device, nor how many devices were affected.