Hardware wallet maker Ledger said on 9 October 2026 that it was investigating reports of stolen funds from users in Southeast Asia who bought its devices from CryptoBilis, a reseller listed in Ledger's official directory for Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments. Ledger advised anyone who bought from CryptoBilis in the last 90 days not to set up the device, and anyone who already had to move their assets to a new Ledger signer with a new recovery phrase.

On 10 October Ledger Support confirmed that one affected user's device contained an unauthorised hardware implant, said it was contacting affected users and working with authorities and the SEAL 911 crypto incident-response group, and said CryptoBilis had suspended sales of its whole hardware-wallet inventory.

Ledger says it believes the drained funds are limited to devices sold through CryptoBilis and has no indication that its own infrastructure, systems or services were compromised.

The Block (9 October) reported on-chain estimates of suspected losses above US$72 million and above US$86 million across Bitcoin, Ethereum and Tron, which Ledger has not confirmed.

Former Mt. Gox chief Mark Karpelès published teardown photos of a Malaysian-bought unit with a small component hidden under the screen, which researchers describe as a cellular implant that reads the 24-word recovery phrase off the display during setup and would still pass Ledger's genuine-device check; Ledger has not described its implant or said how it got into the device. Lesson for anyone holding keys on hardware: buy direct from the manufacturer where possible, and treat a recovery phrase shown on any device as exposed if the device's supply chain is in doubt.

Primary: Ledger Support statements on X. On 14 October BleepingComputer reported that Ledger Donjon confirmed the implant's microcontroller decodes the 24-word recovery phrase shown during setup and exfiltrates it over LTE via a provisioned eSIM, without modifying the Secure Element, Ledger OS, transactions or signatures — so Ledger integrity self-checks still pass. Ledger ordered a broader sales halt covering distributors across Southeast Asia (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia) and Hong Kong, and MediaMarkt pulled stock after users also reported modified devices from other sellers (including a Singapore airport Metapod retailer and MediaMarkt/Aqipa in Europe).

Ledger still says confirmed fund losses are tied to CryptoBilis stock and that its own infrastructure and direct sales channel remain safe; Trezor separately said it will shrink its reseller network.