Ledger has confirmed an unauthorized hardware implant in one device tied to the CryptoBilis wallet-draining investigation. In its October 11 update, the company said all confirmed cases in the disclosed October 9 incident involved devices sold through that Southeast Asian reseller. Its instruction to buyers is unusually concrete: leave unused devices uninitialized; if already set up, move to a new seed on a device bought from Ledger. [1]
The important distinction is between a genuine security chip and everything fitted around it. Separate hardware research shows how an added circuit can watch recovery words travel to a wallet’s screen without breaking the chip that generated them. That research helps explain the risk, but does not establish the precise design of the implant found in the CryptoBilis investigation.
One confirmed implant changes the investigation
On October 10, Ledger Support confirmed the implant in an affected user’s device and said CryptoBilis had stopped sales of all hardware-wallet inventory while the investigation continued. The following day, Ledger said its own systems and direct sales channels remained unaffected and it was working with authorities. It also reminded distributors to use authorized supply channels and never restock returned products. [2]
Those statements establish physical tampering in at least one examined device. They do not identify every affected model, prove that every CryptoBilis unit was altered, or establish who installed the hardware. Ledger has not published a final loss total.
The screen can become the leak
Tibane Labs describes two modified Nano X units obtained in September through Japanese resale channels. Its report explicitly says it has not tested a CryptoBilis device and has no evidence connecting its specimens to that reseller. These are a separate investigation into the same class of hardware threat. [3]
In the documented design, an extra circuit taps the display’s SPI connection—the wires carrying the image to the screen. It recognizes the letters of recovery words and can transmit them using its own cellular modem and SIM. A computer infection or a broken cryptographic algorithm is unnecessary for this route.
The most revealing detail is what the newer specimen no longer changes. Earlier versions made room by shrinking the battery. Tibane’s specimen B leaves the original battery in place and occupies space beneath the OLED display, with black coating that blends into the main board. Checking only the battery would miss that difference.
The genuine-device check can still pass in this design because the secure element itself is authentic. The check and the physical supply chain answer different questions: one verifies a trusted chip; the other determines whether someone added a second computer beside it.
The money trail shows why an emptied wallet is still dangerous
Bitquery’s investigation, updated October 11, counted an estimated $93.2 million taken from 315 wallets across six chains. That is the firm’s on-chain count, not a Ledger-confirmed total or a count of individual customers. Transaction records can show transfers and permissions; they cannot establish how each private key escaped. [4]
Its reconstruction found tightly synchronized activity: 25 TRON wallets signed the same approval within three seconds, following small test transactions in the preceding weeks. The report also describes a wallet drained again on October 10: a regular payer sent it 70,000 USDT, and the attacker pulled those funds about ten minutes later using the existing approval.
That second loss makes the practical problem clear. An empty balance does not retire the address, revoke an attacker’s permissions, or make a possibly exposed recovery phrase private again. Sending new money to the same wallet can recreate the loss.
A replacement device needs a new recovery phrase
Ledger’s current advice to CryptoBilis buyers includes a new seed, not simply a replacement device. Restoring the old phrase on new hardware recreates the old keys. If someone else already knows those keys, changing the object in your hand does not remove their access.
Keep unused affected purchases uninitialized, and use Ledger’s official support site for the migration instructions appropriate to your accounts. Tell regular payers to stop sending to exposed addresses. Preserve purchase records, device details and transaction identifiers for support and a report to local law enforcement; none of those records requires disclosing your recovery words.
Ledger says it will never call, send a direct message, or ask for the 24-word phrase. That boundary matters during the investigation: a supposed recovery service or fake Ledger device check can turn concern about a hardware incident into a separate phishing loss.
The case exposes a gap between authentic hardware and trustworthy delivery. Follow the reseller-specific instructions while the investigation develops, and treat a new recovery phrase as a new set of keys—not a cosmetic reset of the old wallet.
References
- Ledger. “72 hour update on reseller CryptoBilis incident.” X, October 11, 2026. Company update.
- Ledger Support. “Situation Update.” X, October 10, 2026. Hardware-implant confirmation.
- Tibane Labs. “Ledger Nano X: the spy implant.” October 2026, accessed October 12, 2026. Specimen examination.
- Gaurav Agarwal. “The Ledger CryptoBilis hack took $93.2M from 315 wallets.” Bitquery, October 9, updated October 11, 2026; accessed October 12, 2026. On-chain investigation.
