Ledger SAS announced a review of its consumer device sales policies and processes on October 13, 2026. This decision follows a supply-chain attack involving authorized reseller CryptoBilis, which resulted in losses estimated between $72 million and over $93 million, with Bloomberg reporting a figure of $90 million.
The compromised hardware wallets contained unauthorized implants that captured 24-word recovery phrases during device setup. Ledger confirmed that its Genuine Check protocol failed to detect these modifications. The incident, which surfaced around October 9, 2026, primarily affected users in Malaysia, Indonesia, and the Philippines.
CryptoBilis changed ownership in March 2026, and the implants were reportedly introduced after this transition. Ledger stated that devices sold through its direct channels remain unaffected. Additionally, reports of similar hardware implants have emerged in Europe, specifically involving devices sold at the retailer MediaMarkt.
In response to the thefts, Tether has frozen approximately $10 million in USDT associated with the compromised addresses. Ledger has advised recent buyers to refrain from initializing unused devices or migrating funds onto new hardware until the company completes its assessment of the situation.
