Ledger CryptoBilis $102M Drain: Hardware Implant Explained

TL;DR

On October 9, 2026, people in Indonesia, Malaysia and the Philippines who had bought Ledger hardware wallets from the authorized reseller CryptoBilis found their wallets empty. Bitquery's on-chain count puts the whole drain at $102.0M from 324 wallets on six chains, though Ledger has not confirmed how many of those victims bought from CryptoBilis. The main drain reads as one actor holding every key after two weeks of test runs. Ledger has confirmed no figure. On October 10 it said that one impacted user's device "contained an unauthorized hardware implant", and on October 13 it described what the implant does: it reads the 24 recovery words off the screen during setup and sends them out over LTE through an eSIM, without touching the secure element or the operating system. Ledger's own documentation says its Genuine Check cannot detect such a modification while the original Secure Element remains intact. Tether froze $10.0M. The thief moved $23.9M through USDD, which Tether cannot freeze, and sent about 6,840 ETH through Tornado Cash.

What Happened to CryptoBilis Buyers?

The wallets emptied on Friday morning, UTC. By midday two on-chain researchers had posted the collecting addresses: tanuki42 put the loss above $72 million and Specter above $86 million, across Bitcoin, Ethereum and Tron. Ledger's support account then asked CryptoBilis to pause all sales and shipments and told customers who bought from it "in the last 90 days" not to set up their devices, and those who had to "consider moving assets to a new Ledger signer (with new seed)."

CryptoBilis is an authorized seller. The Block describes it as an official Ledger reseller in Indonesia, Malaysia and the Philippines, and Protos notes it also sells Trezor, OneKey, Tangem and SafePal wallets. Buying from an authorized reseller is what Ledger tells customers to do.

The next day Ledger said one victim's device carried an unauthorized implant and that its internal systems and direct sales channels were unaffected. CryptoBilis has since ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger also told resellers to source only through authorized channels and never to restock returned products.

On October 13 Ledger called it a physical supply-chain attack and said it is still investigating where in the distribution chain the devices were tampered with. The same day MediaMarkt Saturn stopped selling Ledger devices after a customer in Germany reported an implant. Ledger reported no loss of funds in that case and has not linked it to CryptoBilis. Trezor removed CryptoBilis as a reseller as a precaution, and OneKey revoked its authorization and offered free replacements.

How Does an Implant Read a Seed Off the Screen?

A hardware wallet keeps its key inside a secure element, a tamper-resistant chip of the kind used in bank cards and passports. The chip generates the seed, signs transactions, and never releases the key. It does have to show you the 24 recovery words once, at setup, so you can write them down. To do that it sends them to the screen.

That trip is the attack surface. Mark Karpelès, the former Mt. Gox CEO, posted photos on October 9 of a Ledger device with LTE components, an antenna, an eSIM and a microcontroller hidden in the buffer pad area behind the screen, with the microcontroller reportedly wired to the SPI bus that carries data to the display. SPI is a plain serial link, readable by anything soldered to the same lines.

SlowMist's CISO, 23pds, sketched the theft the next morning: the seed is generated in the secure element, the words go to the screen for you to copy, the module on the screen's data lines records them, and once it has all 24 it sends them out over LTE. He called it guesswork pending Ledger's findings.

Ledger's own update on October 13 matched that sketch: a microcontroller decoded the 24 words shown during setup, and the implant sent them out over LTE using an embedded SIM. Ledger said the implants did not compromise the security chip or alter transactions.

Genuine Check passes on such a device, and Ledger says why. Genuine Check is a challenge the app sends to the secure element, which answers with a signature from a key injected at the factory. It proves the chip is authentic. In Ledger's words it "cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact," and it "cannot verify the device's physical supply chain history."

The Attack, Step by Step

The table below follows the on-chain record. The first two rows are the implant mechanism as Ledger described it on October 13. Ledger has confirmed an implant in one victim's device and has not said how many others carried one.

Step	When (UTC)	What happened
1	Unknown	An implant is fitted inside a genuine Ledger device's case (Ledger confirmed one in a victim's device; where and when is still under investigation)
2	At setup	The device shows the 24 words; the implant decodes them and sends them out over LTE (mechanism per Ledger)
3	Sep 24 to Oct 7	The thief's control addresses are funded, the Tron one traced to a Bybit withdrawal, then 21 test loops on Tron and 20 on Ethereum
4	Oct 9, 04:59:57	30 Tron wallets add the same new key and lose control of their coins
5	05:07:48 to 05:07:51	A different set of 25 Tron wallets sign the same approval, 13 at once and 12 more three seconds later; $29.0M is gone by 05:07:54
6	05:07 to 05:09	Drains start on BNB Chain, Polygon and Ethereum; three wallets with about 300 ETH each are emptied
7	05:54:20	111 Bitcoin wallets are swept in one block, about 203 BTC
8	10:26 to 10:30	The 30 Tron wallets taken over at 04:59 are emptied, $5.8M
9	12:00 to 12:24	tanuki42 and Specter publish the drain addresses
10	12:09 to 14:10	Tether blocks 37 addresses; 20 of them hold $10.0M
11	13:32	Ledger's statement
12	20:49:21	Nine more Tron wallets are emptied in one block, 8.8 million USDT
13	Oct 10, 17:09	Ledger confirms a hardware implant in one victim's device
14	Oct 13	Ledger describes the implant; MediaMarkt Saturn halts Ledger sales after a report in Germany

The record shows three things about how the thief worked. The 30 wallets in step 4 lost control at 04:59 and were emptied between 10:26 and 10:30, more than five hours later, after their owner permissions had been rewritten to add the thief's key with enough weight to move the coins on its own. On Tron that permission change is a takeover in its own right, so the thief could lock owners out first and drain at leisure. We read that as a thief expecting a response and securing the accounts before it came. Second, the timing. Bitquery found 6 in 10 victim wallets were first funded inside Ledger's 90-day window, so seeds captured at setup over weeks were held until one morning and used together, which kept any single early victim from raising the alarm (our reading). Third, step 12 happened more than seven hours after the addresses were public and Ledger had spoken. Victims who had not yet moved their funds were still being emptied that evening.

The money then split into parallel laundering routes, which is easier to see as a diagram than a list:

rendering diagram…

How Much Was Actually Taken?

About $102M. The first estimates counted only the collecting addresses tanuki42 and Specter had found, so they were floors.

The later figures come from reading every transfer. crypto.news reported Bitquery's early figure of about $92.9M from 311 wallets, and by October 12 CoinDesk carried $93.2M from 315 wallets from Bitquery and $94.5M from 521 addresses from YFarmX. Both counts then rose again. Bitquery found nine Tron wallets emptied of 8.8 million USDT at 20:49 UTC on October 9 and now stands at $102.0M from 324 wallets. YFarmX's count is $103.4M from 530 addresses on seven chains.

The two independent trackers agree on the dollars within about 1.4%. The wallet counts differ because YFarmX counts addresses, and it includes a slower Bitcoin sweep of long-dormant wallets that began on October 7. Bitquery leaves that sweep out: it started two days earlier, drained old wallets one at a time, paid much lower fees and shared no wallets with the main drain, so it may be a different actor. We use Bitquery's $102.0M as the headline because it is the more conservative of the two full-ledger reads. Ledger has confirmed none of these figures, or how many victims bought from CryptoBilis.

Was It the Implant, the Reseller, or Something Else?

Ledger has confirmed one implanted device, and it now says covert hardware in some CryptoBilis-sold devices read recovery phrases and sent them to an attacker. It has not said how many devices were modified, how many victims it has verified, or where the tampering happened.

The on-chain record fits a single cause well but not perfectly. More than 8 in 10 victim wallets were first funded from June onward. That leaves nearly 2 in 10 funded before June. Some of the oldest victims, the dormant Bitcoin wallets YFarmX lists, sit in exactly the sweep Bitquery suspects belongs to someone else. An implant only sees words while the screen shows them, so a wallet whose seed never passed through a tampered device should be safe from it. Restoring an old seed onto a new device would expose an older wallet, though nobody has shown that happened here. Taylor Monahan warned at the time against assuming a zero-day, and some victims may yet turn out to have lost their seed another way.

The reseller is its own question. CryptoBilis's former executives, Arravind Prabu and Vimalatheethan, say they handed over operational control in March 2026 and no longer controlled its systems or customer databases, as crypto.news reports. Changpeng Zhao claimed on X that the attackers "apparently bought the reseller," which CoinDesk notes is unverified. No public evidence ties a change of ownership to the tampering.

Ledger has not said where in the distribution chain the implants were fitted. Its new instruction to resellers, never to restock returned products, suggests returned units are one path it takes seriously (our inference).

Why "Genuine" Is the Wrong Word to Trust

Every hardware wallet threat model draws a line around the secure element and treats everything inside it as safe. This incident lives entirely outside that line. The chip kept the key as designed, and the words were read on their way to the screen by hardware someone had added inside the case.

Audits have the same blind spot. A clean audit covers the code you showed the auditor on the day you showed it, and a passing Genuine Check covers the chip at the moment you plugged it in. Anything added around them afterwards is outside both.

Joe Grand presented the reverse engineering of a real-world hardware implant discovered inside a Ledger Nano X at hardwear.io USA 2026, earlier this year. Nothing ties that unit to CryptoBilis, but it shows the technique was in the wild before this drain. And in July, Coldcard's seed-generation failure showed the same shape from the other side: there the seeds were weak from the start. These were generated properly and leaked on their way to the display.

Could Anyone Have Stopped the Money Once It Moved?

The first wave was beyond anyone's reach. Seed theft on a user's own device happens before any contract, monitor or audit is in the loop. What followed was a race that lasted days, and parts of it were winnable.

Tether's blacklist landed at 12:09 UTC, seven hours after the first pulls, and froze $10.0M in 20 wallets. The thief also parked $23.9M in USDD, which Tether cannot freeze, and by Bitquery's trace later swapped all of it into ETH through THORChain. About 6,840 ETH went into Tornado Cash between October 9 and 13, and most of what came out went on through Zcash, some of it returning as USDC. On October 13 Bitquery could still find about $84M on-chain, including 2.38 million USDC in two wallets that are likely the thief's and that Circle can freeze. Victim wallets were still being emptied more than seven hours after the drain addresses were public.

What decides the size of the final loss is how fast someone maps the collectors across chains and gets the freezable assets in front of the issuers and exchanges that can act. YFarmX's trace has the thief converting USDT into USDD from 10:49 UTC, 80 minutes before Tether's first blacklisting, with 15.15 million USDT gone that way by 16:00. That conversion window was open for hours, and collectors flagged earlier in it would have left more of the money as freezable USDT (our inference from those timestamps). When it is your treasury or your users, our incident response team runs that work in parallel: fund tracing across chains, through mixers and to exchange deposit addresses, coordination with exchanges for freezes, and liaison with law enforcement.

What Should Treasuries and Holders Do Now?

Treat any seed shown on a device of uncertain origin as leaked. If a Ledger came from CryptoBilis, follow Ledger's advice: do not set up an unused device, and move funds from a used one to a new seed generated on a device bought from Ledger. A new device with the old seed fixes nothing.
Do not read "genuine" as "unmodified." Genuine Check attests the secure element. For signer devices that guard real money, buy direct from the manufacturer, record serials on arrival, and inspect the board against the manufacturer's reference photos before first use, as Ledger's guide suggests for anyone with doubts.
Do not let one device vendor or one sales channel hold a treasury. A multisig whose signers come from different vendors, bought through different channels, makes a single tampered batch insufficient.
Watch for permission changes on Tron accounts you control. Thirty wallets here had a new key added at 04:59, more than five hours before they were emptied. By then their owners were already locked out, so the alert cannot save that account. It does say the seed is gone, and one seed derives the keys for every chain a wallet holds, so it is the cue to move whatever that seed still controls elsewhere.
Have the freeze contacts ready before you need them. Tether froze $10.0M within hours; USDD was outside its reach and the thief moved there. Know who can freeze what you hold, and how to reach them in the first hour.

Frequently Asked Questions

Was Ledger hacked?

No. Ledger calls it a physical supply-chain attack, says its internal systems and direct sales channels were unaffected, and says every confirmed loss involves a device sold through CryptoBilis, without saying how many of the drained wallets it has confirmed. The confirmed problem is an unauthorized hardware implant in at least one device sold through that reseller.

Does Ledger's Genuine Check detect a hardware implant?

No. Ledger states that Genuine Check cannot detect unauthorized physical modifications, such as spying implants, if the original Secure Element remains intact. It proves the chip is authentic. The board around the chip is outside what it checks.

How much was stolen in the Ledger CryptoBilis drain?

About $102M by Bitquery's count of 324 wallets, and $103.4M from 530 addresses by YFarmX's. Early estimates of $72M to $86M counted only the first published addresses. Ledger has not confirmed any figure, or how many of the victims bought from CryptoBilis.

Are Ledgers bought directly from Ledger affected?

No confirmed case so far. Ledger says it has no reports involving devices bought directly from it, and every confirmed loss traces to CryptoBilis. Treat that as an absence of reports and nothing more. Where the implants were fitted is still unknown, and a customer in Germany reported one in a unit from MediaMarkt. Inspect any device before trusting it with real money, wherever it came from.

Ledger CryptoBilis $102M Drain: An Implant the Genuine Check Cannot See