Remember the hacked Ledger wallets? The problem may be bigger than first thought. Here's what you need to know in 6 cards

On Oct. 9, Ledger, the French manufacturer of crypto hardware wallets, began investigating reports that customers who purchased devices through CryptoBilis, an authorized reseller in Southeast Asia, had lost their funds.

These devices are supposed to keep the secret keys controlling users' crypto away from hackers. But investigators found a hidden circuit board equipped with a microcontroller.

Ledger told recent CryptoBilis buyers not to activate unused devices and advised existing users to consider moving their funds to wallets with newly generated recovery phrases.

The Coinformer also found that CryptoBilis had quietly changed ownership earlier in 2026, before the period Ledger initially identified as potentially affected.

Possibly. New reports suggest suspicious devices may have reached other retailers.

On Oct. 11 and 12, an X user known as Johannes said he found unusual components inside two Ledger Nano X wallets purchased from separate MediaMarkt stores in Germany, one of Europe's largest electronics retail chains.

Former Mt. Gox CEO Mark Karpelès, who has been examining suspected tampered devices, separately said on X that a Ledger Flex purchased at Singapore Airport contained a "spy implant." According to Karpelès, its owner, Ben Yorke, noticed suspicious marks and sent the device for inspection before using it.

Another user reported suspicious hardware in a Ledger bought through a Philippine LazMall seller.

But none of these reports independently establishes that the same attacker or compromised distribution chain was involved.

Ledger said on Oct. 11 that all confirmed cases of the Oct. 9 wallet-draining incident still traced to CryptoBilis. On Oct. 13, it was reportedly examining other allegations as well.

Because the attacker may not need to break its security chip at all. On Oct. 13, Ledger said its Donjon security research team had identified implants capable of reading the 24-word recovery phrase displayed during wallet setup.

The hidden hardware reportedly contained a microcontroller, a cellular modem and an embedded SIM card, allowing it to transmit the recovery words to an attacker through a mobile network.

With those words, someone could recreate the wallet elsewhere and transfer its cryptocurrency without ever handling the original device.

Worse, the compromised device could still pass Ledger's official Genuine Check.

That's because the check verifies the authenticity of the Secure Element, the chip protecting cryptographic secrets. Ledger's own technical documentation acknowledges that it can't detect an additional spying implant if the original chip remains intact.

Potentially more than $100 million, although Ledger hasn't confirmed the amount.

Blockchain analytics company Bitquery said in its Oct. 12 investigation that it had traced approximately $102 million taken from 324 wallets across Bitcoin, Ethereum, TRON, Solana, BNB Chain and Polygon.

The analysis also identified coordinated withdrawals and transactions, suggesting that one attacker may have controlled numerous victims' keys. Tether reportedly froze approximately $10 million in suspected stolen USDT.

But those blockchain findings do not establish that all 324 wallets were compromised through the same hardware implant.

There's another unanswered question about how long suspect devices had been circulating.

Ledger initially warned customers who purchased from CryptoBilis within the previous 90 days. OneKey, another hardware-wallet manufacturer, later offered replacements for CryptoBilis purchases dating back to March 1, citing the reseller's ownership handover.

There's no confirmed evidence that the same implant attack compromised their devices. But several manufacturers have already taken precautions, while another reported a separate security incident.

• OneKey revoked CryptoBilis's reseller authorization, suspended onboarding new resellers and began reviewing its distribution network. It also offered free replacements for eligible CryptoBilis buyers.
• Trezor said it had found no indication that its products were affected, but removed CryptoBilis from its authorized reseller network.
• CoolWallet took a different approach. CoolBitX CEO Michael Ou told The Coinformer that CryptoBilis remained an authorized reseller, with no reported losses or suspected tampering involving its devices.
• Tangem disclosed a separate security incident on Oct. 9 involving unauthorized access to a third-party customer support system. The Swiss hardware wallet maker with Russian roots said a limited number of customers' names and email addresses may have been exposed, but their wallets and funds remained safe. It remains unclear whether its support system breach has any connection to the CryptoBilis incident.

CryptoBilis has suspended hardware-wallet sales across brands as the investigation continues.

Damaging a wallet doesn't automatically destroy your crypto, which lives on the blockchain. But if the device stops working and you have no usable recovery backup, you could permanently lose access to your funds.

If you suspect your device was tampered with, the safer approach depends on whether you've already used it.

• If it's unopened or hasn't been initialized, don't set it up. Preserve the device and packaging and contact Ledger through its official support website.
• If it has already held funds and you have reason to suspect tampering, generate an entirely new recovery phrase on a trusted, uncompromised device and transfer your assets there. Don't reuse the old phrase, even on a new Ledger.
• And never give your recovery words to anyone claiming they can verify or repair the device. Ledger says its staff will never ask for them.