Hackers reportedly drain up to $93 million through compromised Ledger reseller

A hardware wallet is supposed to be the vault you buy so you never have to trust anyone else. That premise just took a serious hit.

Attackers reportedly planted hidden hardware inside Ledger wallets sold through an authorized Southeast Asian reseller, CryptoBilis. Estimated losses range from $72 million to upwards of $93 million, spread across hundreds of wallets.

Ledger confirmed on October 10, 2026, that at least one affected device contained an unauthorized hardware implant. The company has told CryptoBilis to stop all sales and shipments of its devices.

The implants are described as small circuit boards with cellular capabilities, tucked behind the device screens. Their job was to capture a user's 24-word recovery phrase and send it out over cellular networks.

The recovery phrase is the master key to a crypto wallet. Anyone holding those 24 words can rebuild the wallet on another device and move the funds, no physical access required.

A post on X claimed the attackers went further than tampering with stock. According to that post, the hackers bought a reseller outright, had it sign a non-disclosure agreement, and stole over $80 million by slipping spy chips into the wallets. That account of the reseller purchase and the NDA has not been confirmed by Ledger.