Ledger traces $93M wallet thefts to tampered devices from reseller
Ledger has linked confirmed wallet-draining incidents to hardware wallets purchased from Southeast Asian reseller CryptoBilis, while on-chain analysts estimate losses above $93 million. The company confirmed one device contained an unauthorized hardware implant; a detailed account from Mark Karpelès describes a hidden circuit under the screen that can capture the recovery phrase and send it to an attacker. Ledger says its own systems and direct sales were not breached, is working with authorities, and is advising affected customers to contact support and law enforcement.
Ledger attributed all verified drain cases from Oct. 9, 2026 to hardware bought via CryptoBilis, a Southeast Asian reseller. On-chain estimates placed suspected losses above $93 million. Ledger maintained its own infrastructure and direct sales were untouched, and said it was cooperating with authorities while contacting affected owners.
Mark Karpelès reported buying a compromised unit in Malaysia. He described a concealed board beneath the screen containing a microcontroller, antenna, LTE component, and e-SIM. Because the genuine security chip remained, the device passed Ledger’s authenticity check and arrived shrink-wrapped, making visual detection difficult unless opened.
This incident may deepen doubts about buying security hardware through third-party resellers, since tampered devices could pass authenticity checks. Affected owners could lose funds irreversibly, while other crypto users may shift to direct purchases or new wallets. It may also prompt resellers and manufacturers to tighten inventory controls and customer warnings. Broader trust in hardware wallets as self-custody tools could suffer, though the reported compromise appears tied to a specific reseller rather than Ledger’s own systems.