Criminals stole between $90 million and $93 million in cryptocurrency from over 300 users by tampering with Ledger hardware wallets. The compromised devices were distributed through CryptoBilis, an authorized reseller based in Southeast Asia.
The attackers modified the hardware before it reached customers by installing microcontrollers designed to capture 24-word recovery phrases during the initial setup process. These implants utilized LTE and eSIM technology to transmit the stolen data, bypassing the users' local networks.
The coordinated theft campaign began around October 9, 2026. Ledger has confirmed the compromise and stated that the issue is limited to units sold by CryptoBilis. The company advises customers who purchased devices from this reseller in the last 90 days to avoid initializing them.
Tether has intervened by freezing USDT assets associated with the compromised wallets. While this provides a partial recovery mechanism for stablecoin holders, decentralized assets like Bitcoin remain vulnerable as they lack a central authority capable of blocking transactions.
