Hackers Allegedly Steal Up to $93 Million via Compromised Ledger Reseller

Hackers have reportedly drained between $72 million and $93 million from users of Ledger hardware wallets through a compromised reseller, CryptoBilis, based in Southeast Asia. Ledger confirmed on October 10, 2026, that at least one of the affected devices contained an unauthorized hardware implant designed to capture users' 24-word recovery phrases, which are essential for accessing cryptocurrency wallets. The company has instructed CryptoBilis to halt all sales and shipments of its devices.

The attack is believed to have involved hidden circuit boards with cellular capabilities, placed behind the screens of Ledger wallets. These implants transmitted sensitive recovery phrases over cellular networks, allowing attackers to access and transfer funds without needing physical access to the devices. The unusual activity was first detected around October 9, 2026, with significant inflows to theft addresses across various blockchains, including Bitcoin and Ethereum.

Researcher Mark Karpelès has documented multiple generations of these implants, which were reportedly designed to evade Ledger's security protocols. The majority of the losses occurred between October 9 and October 10, with some stolen funds being funneled through mixers like Tornado Cash. In response, Tether has frozen approximately $10 million in USDT linked to the theft addresses. Ledger maintains that the issue is limited to the reseller channel and that its core systems remain secure, leaving customers who purchased devices from CryptoBilis in a precarious position regarding the security of their wallets.

© 2026 KLEA News. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Source: KLEA News