Ledger Blames Reseller, Not Its Supply
An unauthorized hardware implant discovered in Ledger devices has led to the siphoning of as much as $93.
As of October 11, CryptoBilis had suspended all hardware wallet sales pending the outcome of an ongoing investigation. Ledger has advised any customer who purchased a device from CryptoBilis in the past 90 days to move their assets immediately to a new wallet with a freshly generated recovery phrase. The company maintains that only devices from this particular reseller are implicated so far.
How the Implant Slipped Through
The attack was enabled by an unauthorized implant physically embedded within at least one Ledger device. This tampering allowed attackers to siphon funds once users set up their wallets, typically by compromising or leaking the recovery phrase—a critical security element for accessing crypto holdings. While most cases have been linked to CryptoBilis in Southeast Asia, a related incident surfaced in Europe when a user named Johannes reported buying a tampered Ledger from MediaMarkt, a major electronics retailer. The European implant appeared to be an earlier variant compared to those found in Asia, and former Mt Gox CEO Mark Karpeles noted that the presence of an antenna suggested it was a “Eurasian version.”
Ledger has not confirmed whether these European cases are directly connected to the Southeast Asian attack.
Tether’s Freeze Leaves Millions Unrecovered
Blockchain analytics firms Bitquery and YFarmX estimate between $86 million and $94.5 million was drained from more than 300 wallets across six or seven blockchains, including Bitcoin, Ethereum, and Tron. Of the stolen funds, Tether froze $10 million in USDT associated with the theft—leaving over $80 million still circulating or hidden on-chain as of October 11. Some of these assets have been routed through privacy tools like Tornado Cash and Zcash, complicating recovery efforts.
Bitquery reported that about $81 million remained traceable on-chain days after the initial exploit. Yet despite these figures, both Bitquery and YFarmX caution their estimates are based only on public blockchain data; the true extent of losses directly attributable to compromised Ledgers remains uncertain.
See Also
Hardware Wallets Under Renewed Scrutiny
The scale of this exploit has reignited debate over whether self-custody via hardware wallets is truly safer than entrusting assets to institutional custodians or exchange-traded funds (ETFs). In light of both the Ledger incident and a July 2026 Coldcard seed-generation flaw—which enabled attackers to drain up to $130 million in bitcoin—some prominent holders are reconsidering their approach. Analyst Plan B publicly stated he would move his bitcoin holdings into ETFs in 2025 due to these persistent vulnerabilities.
Not everyone agrees that mass migration is wise; Bitcoin security researcher Jameson Lopp warns that shifting large amounts into ETFs could simply create new central points of failure. Meanwhile, Adam Back of Blockstream points out that many hardware wallet manufacturers have failed to address generic attack vectors for years—suggesting systemic issues extend beyond any single company or product line.
Why it matters: Practical Impact for Users
For everyday crypto users—especially those who bought Ledgers from CryptoBilis—the fallout is immediate and concrete: millions lost, assets frozen or unrecoverable, and urgent recommendations from Ledger itself not to use potentially compromised devices. The contrast is stark: while Tether’s intervention managed to freeze $10 million quickly, over eight times that amount remains lost or obfuscated through privacy mixers.
The situation also exposes tension between perceived safety and real-world outcomes: hardware wallets promise control but can fail spectacularly if supply chain security breaks down. As ETF adoption rises among large holders seeking “enhanced security,” according to industry executives, questions linger about whether decentralization can coexist with robust protection against sophisticated attacks—and whether users can realistically assess which risks are greater.
What to track going forward
If Ledger confirms that the tampered device purchased from MediaMarkt in Europe is linked to the same hardware implant attack as the CryptoBilis cases in Asia, this would immediately expand the known geographic scope of affected devices beyond Southeast Asia; as of Oct. 11, such a connection remains unclear and unconfirmed by Ledger.