Ledger reseller breach tied to $93M in stolen crypto
Attackers allegedly installed hidden cellular implants in Ledger hardware wallets sold by authorized Southeast Asian reseller CryptoBilis. The implants reportedly captured users' 24-word recovery phrases and transmitted them, leading to losses estimated between $72 million and $93 million across hundreds of wallets. Ledger confirmed at least one affected device had unauthorized hardware and told CryptoBilis to halt sales, while Tether froze about $10 million in linked USDT.
The reported compromise centers on devices distributed by CryptoBilis, a reseller serving Malaysia, Indonesia, and the Philippines. Investigators described tiny cellular-equipped boards concealed behind screens, designed to lift the 24-word recovery phrase and relay it wirelessly. Ledger stated on Oct. 10, 2026, that one inspected unit contained unapproved hardware and directed CryptoBilis to cease selling and shipping devices.
Researcher Mark Karpelès reportedly identified multiple implant versions in Southeast Asian purchases. The suspicious outflows began around Oct. 9, 2026, across Bitcoin, Ethereum, and USDT, with some funds sent through Tornado Cash. Tether reportedly froze roughly $10 million in linked USDT. Ledger maintains its own systems and directly sold products were not implicated.
People who bought wallets through this reseller may face heightened risk of irreversible loss, while the broader crypto community could grow more wary of third-party sellers. Hardware wallet makers may face pressure to strengthen supply-chain checks and buyer verification. Stablecoin issuers and exchanges could become more involved in freezing or tracing stolen funds, potentially affecting innocent users if addresses are misidentified. The episode may also shape how consumers view self-custody: as empowering, but dependent on trustworthy hardware and distribution.