Key TakeawaysLedger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from SouthKey TakeawaysLedger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from South

Ledger Hack Explained: Hardware Implant Found in CryptoBilis-Sold Wallet as Losses Near $93 Million, and How to Protect Your Device

#行业观察

NEAR$5.3267+10.38%

NOT$0.0004096+2.50%

作者：OoJae

2026/10/12 13:30

Key Takeaways

Ledger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from Southeast Asian reseller CryptoBilis reported drained wallets.

Onchain estimates of the losses range from more than $72 million to about $93 million. Blockchain analytics firm Bitquery counts more than 300 victim wallets, most on TRON and Bitcoin, drained within hours on October 9. Ledger has not confirmed a figure.

Ledger says it has "no indication" its own systems were compromised. The evidence points to a supply chain attack through a single official reseller covering Indonesia, Malaysia and the Philippines, which has suspended sales.

Anyone who bought a Ledger from CryptoBilis in the last 90 days should not set it up. If it is already in use, Ledger advises moving funds to a new device with a newly generated recovery phrase.

The thief is laundering through Tornado Cash, cross-chain swaps and the USDD stablecoin, while Tether has frozen about $10 million in USDT linked to the theft.

What Happened

The first warnings came from users. On October 9, Ledger owners in Southeast Asia began reporting on X and Reddit that their wallets had been emptied, and onchain investigators quickly linked the victims to devices bought through CryptoBilis, a Kuala Lumpur-based company listed on Ledger's official reseller directory for Indonesia, Malaysia and the Philippines. Researcher tanuki42 traced more than $72 million to suspected theft addresses, investigator Specter put the figure above $86 million across Bitcoin, Ethereum and TRON, and MistTrack cited almost $90 million.

The most detailed count so far comes from Bitquery, which tallies about $93.2 million taken from 315 victim wallets across six chains, led by TRON at about $70.5 million and Bitcoin at $16.8 million. Its timeline suggests careful preparation. The attacker's control addresses were funded on September 25 and ran test transactions until October 7. Then, early on October 9, the attacker added a new key to 30 TRON wallets, locking out their owners, and began draining at about 05:07 UTC, hitting five chains within 47 minutes.

Ledger Confirms a Hardware Implant

On Friday, Ledger said it was investigating and asked CryptoBilis to pause all sales and shipments. On Saturday it went further: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The company added, "We have no indication that Ledger's security infrastructure, systems or services have been compromised." Ledger says it is working with law enforcement, has thanked the SEAL 911 incident response group for its help, is contacting affected users, and is developing additional protections against physical tampering. It has not said how many devices contain implants or whether the implant explains every drained wallet.

Independent teardowns point the same way. Mark Karpelès, the former Mt. Gox CEO, reported a tiny component, about two by two millimeters, hidden near the screen of a Ledger Nano X that arrived from Malaysia in apparently intact shrink-wrap, and said "the only way to detect the implant is to open the device." Security firm Tibane Labs described a microcontroller and cellular hardware wired to the screen's data lines, consistent with a device that could read a recovery phrase as it is displayed during setup and send it out. Ledger has not confirmed that analysis. A separate claim from a buyer in Europe about a tampered device has not been verified, and observers disagree about the photos.

Why This Is a "Ledger Hack" That Did Not Hack Ledger

Searches call it the Ledger hack, but the evidence so far describes a supply chain attack: devices modified somewhere between the factory and the customer, not a flaw in Ledger's chips, firmware or servers. Binance co-founder Changpeng Zhao said the available information pointed to a supply chain attack at a single vendor and reminded users that "self-custody comes with extra responsibilities." CryptoBilis has suspended sales of its hardware wallet inventory until the investigation concludes and remains in contact with Ledger, which has made no accusation against the reseller. The incident follows the Coldcard wallet hack and the Trezor and SafePal data leaks earlier this year, and it shows that the security of a hardware wallet depends on where it came from as much as on the brand.

Where the Stolen Funds Went

The laundering began within hours. According to Bitquery, 1,254 ETH went through Tornado Cash on October 9, about 20 million USDT was bridged to Ethereum and swapped for ETH, and roughly $15 million was converted into USDD, a TRON-based stablecoin that Tether cannot freeze. Swap services including Relay, Chainflip and NEAR Intents carried more. Tether blacklisted 37 linked addresses and froze about $10 million in USDT, but as of October 10 about $16.8 million in Bitcoin sat unmoved and roughly $40.9 million was held as ETH in the thief's wallets.

What Ledger Owners Should Do Now

Bought from CryptoBilis in the last 90 days and not set up yet: do not set it up. Ledger's words: "We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up."
Already using a CryptoBilis device: "consider moving assets to a new Ledger signer (with new seed)," as Ledger advises, using a device bought directly or from a verified reseller.
Any hardware wallet: reject a device that arrives with a pre-printed recovery phrase, confirm that a new phrase is generated on first start, and treat unusually low prices or unexpected shipping origins as warning signs.
Never share your 24-word recovery phrase. Ledger "will never ask users to disclose their 24-word recovery phrase," and fake recovery services typically follow incidents like this one.
If you were drained: save the transaction hashes, contact SEAL 911, file a police report, and notify Tether if USDT was taken.

What It Means for Traders on MEXC

Hardware wallets remain one of the safest ways to hold crypto long term, but this incident is a reminder that the chain of custody matters as much as the device. Traders who move funds between MEXC and a hardware wallet can reduce risk by buying devices only from the manufacturer or verified resellers, testing a new wallet with a small withdrawal first, and using two-factor authentication, an anti-phishing code and a withdrawal address whitelist in their MEXC security settings.

Disclaimer: This content is for educational and reference purposes only and does not constitute any investment advice. Digital asset investments carry high risk. Please evaluate carefully and assume full responsibility for your own decisions.

市场机遇

NEAR实时价格 (NEAR)

$5.3267

$5.3267$5.3267

USD

NEAR (NEAR) 实时价格图表

本页面分享的文章均源自公开平台，仅供参考。该内容不代表 MEXC 的立场或观点。所有版权归 OoJae 所有。如果您认为任何内容侵犯了第三方的权益，请联系 service@support.mexc.com 以便及时删除。 MEXC 不保证任何内容的准确性、完整性或及时性，且不对基于所提供信息而采取的任何行动负责。本内容不构成财务、法律或其他专业建议，亦不应被解释为 MEXC 的推荐或认可。如需专家见解和深入分析，请造访 MEXC 学院。