At 04:59 UTC on 9 October, 30 TRON wallets quietly handed control to a new key. Their owners had not touched them. Eight minutes later, the money started moving, and within an hour the attacker had emptied wallets on six blockchains. Bitquery's on-chain investigation counts $93.2 million taken from 315 wallets.

The victims had one thing in common: they bought their Ledger hardware wallets from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines. A day later, Ledger confirmed that one affected device contained an unauthorized hardware implant. Nothing suggests the secure chip was broken. It didn't need to be. The leading explanation is that the seed phrase was read off the device's own screen when it was shown to its owner.

What happened in the Ledger CryptoBilis attack?

Times are UTC. Malaysia runs on UTC+8, so the drain began just before 1 p.m. local time.

The warning came first. It was raised by Mark Karpelès, best known as the former head of Mt. Gox, the Bitcoin exchange that collapsed in 2014, and lately one of the few people publicly tearing down suspect Ledger devices and sharing his findings. On 8 October, a day before the first theft, he warned that tampered Ledger devices with hidden SIM-based implants were being sold (BigGo Finance). He described the right mechanism, but he named no reseller or wallets, and he does not state whether his own device came from CryptoBilis (Martin Cid Magazine). His post could prompt owners to create new seeds but it could not stop someone who already held the keys. The attacker had been testing since 25 September, so the warning did not trigger the attack. Whether it sped up the attack is still unclear.

How far does it go? Ledger says the incident appears to be limited to this one reseller and that its own infrastructure was not compromised (Cointelegraph). CryptoBilis has suspended hardware wallet sales and claims to be cooperating with the investigation (BigGo Finance). Ledger's advice covers purchases from the last 90 days. Bitquery found that more than 8 in 10 victim wallets were first funded from June onward, so earlier buyers should take the same steps. The European report concerns a single device; its owner says no funds have been taken, and Ledger has not commented on it (Benzinga). Scope beyond CryptoBilis is unknown, though not ruled out.

How did the attacker steal the seed phrases?

People often confuse three different ways a hardware wallet can fail. It can show one thing on screen while signing another. It can sign a malicious transaction that its owner approved without understanding it. Or it can leak its seed phrase, giving away every key it will ever generate. Everything made public so far points to the third.

The blockchain shows it. Twenty-five TRON wallets signed the same approval within three seconds. 111 Bitcoin wallets were swept in a single block. 30 TRON wallets had their permissions rewritten, an action only the owner’s key can authorize (Bitquery). That is software holding the keys, not people clicking through bad prompts. No victim had to approve anything.

What Ledger has confirmed: an unauthorized implant in one affected device. It has not published what the implant does.

What has been described, but not confirmed: Karpelès's own unit, a Nano X shipped from Malaysia in intact shrink wrap, held a second board where the screen padding should be. It carried a microcontroller watching the display, an LTE module with a data eSIM, and an antenna. In his account, it recognises the setup screen, reads the 24 words as they are drawn, and sends them out as text over the mobile network (BigGo Finance). Joe Grand's teardown of the earlier Thai implant found the same design: a separate chip tapping the display's data line, and a smaller battery to make room (Joe Grand).

Why the secure element did not help. The secure chip generates and protects the seed, but you have to see the words to back them up. Those pixels travel to the screen over a line an add-on board can listen to. Nothing in the firmware changes, which is why, per Karpelès, the device still passes Ledger's Genuine Check: the check verifies the chip and firmware, not what else is wired beside them. By the same logic, a passphrase typed on the device would also be visible. That last point is our inference, not a tested finding.

Still open: whether every drained wallet was compromised the same way, how many devices were altered, and where between factory and buyer the boxes were opened.

Is this only a Ledger problem?

No other manufacturer has been shown to be affected. But the attack targets a moment every seed-based hardware wallet shares: the recovery phrase shown on screen for backup. CryptoBilis also resold Trezor, Tangem, OneKey and SafePal devices, and whether any of that stock was affected has not been established (Martin Cid Magazine).

No distribution model can fully guarantee what happens to a sealed box between the factory and the buyer. Shrink wrap and seals can be reproduced by anyone with enough time and access, and Ledger says it is developing further anti-tampering measures. In the meantime, an attacker with access to a box needs no exploit and no phishing page. The owner can do everything right and still lose.

After Bybit, whose $1.4bn loss started with a socially engineered developer, many teams reviewed their setups. Do the same now, before the next incident rather than after it. List what you trust without checking (the device, the channel it came through, the screen, the single seed) and ask what happens if one of them fails.

What should Ledger owners do now?

It depends on where your device came from. Check Ledger's official channels before acting; a viral post is not a confirmed scope.

You bought from CryptoBilis (at any date), or your device is confirmed compromised. Act promptly: the attacker may already hold working keys.

• Unused device: don't set it up. Keep it, the box and the receipt (Ledger Support).
• Already set up: treat the seed as known. Buy a new device directly from a manufacturer, generate a new seed on it and move your funds. Sending coins to another account on the same seed achieves nothing, because every address it derives is exposed.
• Confirm the receiving address on the new device's screen, and send a small test amount first.
• On TRON, check your account permissions in a block explorer. An unfamiliar key means someone else controls the account.
• Already drained: save the transaction hashes and contact SEAL 911, which is assisting Ledger. Report USDT losses to Tether, which has frozen about $10M.

You bought from another reseller, a marketplace, second-hand or at a discount. There's no confirmed link, but you can't verify the device's path.

• If meaningful value sits on that seed, plan a migration to a fresh seed on a device bought direct. Plan it; don't rush it. A hurried transfer to a mistyped or poisoned address is a new way to lose funds.
• Don't open the device because of photos online. You can damage it and still learn nothing conclusive.

You bought directly from the manufacturer. There's no sign these devices are affected. Nothing changes.

Everyone. Ledger will never ask for your 24 words, and thefts like this attract fake "recovery services" that ask for exactly that (Martin Cid Magazine). No support agent or investigator needs your seed phrase.

How to protect your seed phrase from the next supply-chain attack

Keep it off every digital device. Never type, photograph, scan, cloud-store or paste your seed phrase. Treat any request to enter it into software as a red flag, unless you chose that recovery procedure deliberately and for a specific reason. Backing up a seed means writing it on paper or steel. Exposing it means letting a computer, phone or camera see it. This attack adds a harder lesson: here the exposure point was the hardware wallet's own screen. No backup discipline can repair a seed that leaked when it was created.

Split the backup, and know what splitting does. Opsek's seed phrase sheet divides a 24-word phrase into three parts, any two of which recover it, using only pen and paper. That removes the single sheet as a point of theft or loss. It also adds risks of its own: parts stored together, parts lost until you can no longer reach two, and copying mistakes that only surface at recovery. Understand what one part reveals on its own before deciding where to keep it, and rehearse a recovery with a dummy phrase first. No split protects a seed that was read before the backup existed.

Independent boundaries beat more devices. Three devices loaded with the same seed are one secret exposed three times. Real diversification means separate seeds, generated on devices from different manufacturers, bought through separate channels, and combined so that no single one can move funds. That is what multisig does. In Casa's 3-key vault, any 2 of 3 keys can send, and the recovery key Casa holds cannot move funds on its own (Casa). Institutions use MPC platforms such as Fordefi, which adds policy controls and transaction simulation, or Fireblocks. These serve very different users, and none is immune to compromise. Each extra key is also another procedure to get wrong. The goal is to reduce correlated risk, not to collect hardware wallets.

Verify what you sign, and where it came from. A hardware wallet is a strong control, not a guarantee. Buy direct, generate the seed yourself, never accept pre-written words, and check every address on the device. Don't play Russian roulette with your life savings.

Hardware wallet weights: a quick tamper check, and its limits

These are the device-only weights the manufacturers publish. Weigh the bare device, without cable, case or film, on a scale with 0.1 g resolution.

A spy implant has to be tiny and light to fit inside a device this small. The eSIM Karpelès found is a 2 × 2 mm chip, and the implants documented so far made room by shrinking the battery or taking the place of the screen padding (Joe Grand: https://grandideastudio.com/portfolio/security/ledger-hardware-implant/). The weight difference can therefore be very small, sometimes within the rounding of the published figure. That’s why you need a scale that reads to 0.1 g. A clear mismatch is a reason to stop using the device and contact the manufacturer. A match proves nothing, and production revisions shift the figures too. Weighing is a cheap first screen worth doing, not a verdict on the hardware or firmware.

If the weight is off, or you bought through a channel you can’t verify, Karpelès has published a video showing how to open a Nano X and inspect the board: https://www.youtube.com/watch?v=5zRkNoyqy4Y. A genuine board has no extra module and no stray cables; according to Karpelès, the out-of-place antenna wire is the easiest tell. Opening the case can damage the device and may void its warranty, so do it only if you have a concrete reason to suspect it.

Sources

• Bitquery: The Ledger CryptoBilis hack took $93.2M from 315 wallets (10–11 Oct 2026): on-chain timeline, signing patterns, losses, Tether freeze.
• Ledger Support on X (9 Oct 2026): investigation, sales pause, advice to buyers.
• Cointelegraph: Ledger confirms unauthorized hardware implant (11 Oct 2026): implant confirmed in one device; incident described as isolated.
• Martin Cid Magazine: Ledger finds a hidden chip in a crypto wallet (11 Oct 2026): open questions, SEAL 911, other brands resold.
• BigGo Finance: Ledger hack losses top $90 million (10 Oct 2026): Karpelès's 8 Oct warning and his account of the implant.
• Joe Grand: Reverse Engineering a Ledger Nano X Hardware Implant (2026): teardown of the earlier Thai implant.
• 0xJohannes on X and Benzinga (11 Oct 2026): the unverified European report.
• Opsek seed phrase sheet, Casa, Fordefi: backup and multisig options.