Attackers compromised hardware wallets sold by the Southeast Asian reseller CryptoBilis by installing unauthorized cellular implants. These devices, which served customers in Malaysia, Indonesia, and the Philippines, were modified to capture 24-word recovery phrases and transmit them over cellular networks.
Ledger confirmed the presence of implants in at least one device on October 10, 2026, and ordered the reseller to halt all sales and shipments. The company stated that the issue is limited to this specific reseller channel and does not affect its core systems or direct sales.
Estimated losses from the incident range from $72 million to over $93 million, affecting hundreds of wallets. Most of the unauthorized fund transfers occurred between October 9 and October 10, 2026, across Bitcoin, Ethereum, and Tether networks.
Tether has frozen approximately $10 million in USDT associated with the theft addresses. Some stolen funds were reportedly routed through mixers like Tornado Cash. Researcher Mark Karpeles documented multiple generations of implants designed to bypass Ledger security protocols.
