Ledger Says All Confirmed Wallet Drains Trace Back to…

Published: October 12, 2026 – 14:11 UTC

Ledger has confirmed that an unauthorized hardware implant was found inside a device belonging to a user affected by the October 9 wallet-draining incident, providing the first physical evidence that at least part of the attack involved tampering before the wallet reached its owner.The hardware wallet manufacturer said all confirmed cases identified so far involve devices sold through CryptoBilis, a reseller serving Southeast Asia. Ledger said its internal systems and direct sales channels remain unaffected and that the number of impacted devices appears limited.Ledger has not disclosed an official loss figure. Blockchain analytics firm Bitquery estimates that approximately $93.2 million was taken from 315 wallets across Tron, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. That figure remains independent of Ledger’s investigation.

What Has Ledger Actually Confirmed?

Ledger Support said on October 10 that “one of the impacted users’ devices contained an unauthorized hardware implant.” CryptoBilis subsequently stopped selling all hardware wallets while the investigation continues.A day later, Ledger narrowed the confirmed scope further, saying: “To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis.”The finding does not yet establish that every affected wallet contained an implant or that identical hardware caused every reported loss. Ledger has also not publicly detailed exactly how the confirmed implant captured credentials or how it entered the reseller’s inventory.That distinction matters because the attack appears to sit outside the security boundary normally discussed when evaluating a hardware wallet. Hardware wallets are designed to isolate private keys from internet-connected devices, but that protection assumes the hardware itself reaches the user in a trusted state.

Investor Takeaway

The incident shifts hardware-wallet risk upstream: offline keys offer little protection if the physical device is compromised before the owner initializes it.

How Much Crypto Was Reportedly Taken?

Bitquery’s latest on-chain reconstruction puts the loss at $93.2 million across 315 wallets on six networks, above earlier estimates of roughly $86 million.The firm counted about $70.5 million taken from Tron wallets, $16.8 million in Bitcoin and $3.7 million from Ethereum, with smaller losses on BNB Chain, Polygon and Solana. Tether froze approximately $10 million in USDT across 20 addresses linked to the flows.Bitquery also found signs of test activity in the two weeks before the main drain and said multiple victim wallets granted control or signed related transactions within seconds of one another. On-chain evidence can show where assets moved and when permissions changed, but it cannot establish how private keys or recovery phrases were obtained.Ledger therefore has not adopted the $93.2 million figure, and the existence of one confirmed implant should not be treated as proof that all 315 wallets were compromised through the same physical mechanism.

Why Is the CryptoBilis Link So Important?

The concentration of confirmed cases around one reseller turns chain of custody into the central investigative issue.Ledger has reminded distributors to obtain stock only through approved channels and not to return previously sold devices to inventory. Customers who bought through CryptoBilis have been told not to initialize unused devices. Those who already set them up are being advised to move assets to a new Ledger device using an entirely new recovery phrase.Questions remain over when tampered units entered CryptoBilis inventory and who had physical access to them. Binance co-founder Changpeng Zhao has claimed publicly that attackers may have acquired the reseller and required its previous operators to remain silent under a nondisclosure agreement. That allegation has not been independently established, and Ledger has not adopted it as part of its findings.CryptoBilis has suspended hardware-wallet sales while the investigation continues.

Investor Takeaway

Authorized-reseller status alone may no longer be enough assurance; provenance, returns handling and custody of inventory are becoming part of wallet security.

Is Hardware Self-Custody Becoming a Bigger Security Problem?

The Ledger case follows another major hardware-wallet incident earlier this year. A July firmware flaw at Coldcard weakened seed generation and was linked to approximately 1,816 BTC, then worth about $116 million, being drained from thousands of addresses. The Coldcard incident involved weakened randomness inside wallet firmware, making it fundamentally different from the physical tampering now under investigation at Ledger.Other hardware designs carry different physical risks. In July, Ledger researchers disclosed a laser fault-injection attack affecting Tangem cards, although that exploit required possession of the device and specialist equipment.The three cases expose different points of failure: software-generated secrets, physical-chip attacks and now potentially compromised distribution.Ledger said it is reviewing reseller controls, strengthening anti-tamper protections and working with authorities. For affected users, however, the immediate question is simpler: whether any additional compromised devices remain in circulation and whether investigators can reconstruct how altered hardware entered an authorized retail channel in the first place.

Source: FinanceFeeds