A supply-chain attack involving tampered Ledger hardware wallets has resulted in the theft of over $93 million to $102 million from more than 324 wallets. The breach was linked to devices sold by the Southeast Asian reseller CryptoBilis.
Ledger confirmed that compromised devices contained unauthorized hardware implants designed to capture 24-word seed phrases during setup. These phrases were transmitted via cellular networks, allowing attackers to gain full control over the victims' assets.
The coordinated attack occurred on October 9, 2026, with funds drained in a rapid burst. Investigators identified inflows in Bitcoin, Ethereum, TRON, and various stablecoins. Individual losses were significant, including one instance involving 80 BTC and another involving over 60 BTC.
Ledger stated that its direct sales channels and internal systems remain secure, attributing the incident to a highly organized criminal group. The company is currently providing updates to customers who purchased devices from CryptoBilis within the last 90 days.
