More than 300 wallets, three blockchains, a single reseller: within a matter of days in October 2026, one of the most serious incidents in the history of the hardware wallet industry unfolded. On-chain researchers estimate the damage from the Ledger hardware wallet hack at $86 to $93 million, funds drained through tampered devices from a single distribution channel in Southeast Asia. Ledger’s own systems were not affected — instead, a batch of devices sold through the Malaysian reseller CryptoBilis was compromised.
For crypto investors worldwide, the case is relevant because it shows how vulnerable even “secure” offline wallets can become once the supply chain itself is compromised. A similar lesson emerged from our report on the XRP Ledger security bug. This article summarizes the confirmed facts, walks through the timeline, and offers practical guidance for affected users.
Table of Contents
Key Takeaways
- The Ledger hardware wallet hack affects exclusively devices sold through the Malaysian reseller CryptoBilis in Indonesia, Malaysia, and the Philippines.
- At least one device was confirmed to contain an unauthorized hardware implant — a so-called spy chip.
- The estimated damage, according to on-chain researchers, ranges between $86 and $93 million, spread across more than 300 wallets on Bitcoin, Ethereum, and Tron.
- Ledger has since expanded its sales-halt request to seven countries and regions: Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong.
- Ledger’s own systems and direct sales channels are not affected according to current findings; users are nonetheless urged to stay alert to scammers exploiting the incident.
What happened in the Ledger hardware wallet hack?
The incident did not begin with an attack on Ledger’s servers, but with reports from individual users. Starting on October 9, 2026, multiple buyers in Southeast Asia reported that cryptocurrency had vanished from their wallets even though they had set up their devices correctly and never entered their recovery phrase online. Ledger responded immediately with an internal investigation.
The common denominator across all reported cases: the devices came from CryptoBilis, a reseller active in Indonesia, Malaysia, and the Philippines. On October 10, 2026, Ledger officially confirmed via its support account on X (formerly Twitter), @Ledger_Support, that at least one affected device contained an unauthorized hardware implant — colloquially referred to as a spy chip.
“At least one affected device contained an unauthorized hardware implant,” Ledger confirmed on October 10, 2026, via its official support channel.
Such an implant could theoretically be used to intercept or manipulate sensitive data, such as seed generation or transaction signing, before the device even reaches the end customer. This is precisely what sets this case apart from classic phishing or malware attacks: the compromise happened physically, already within the supply chain, long before the user ever unboxed the device.
Damage total: $86 to $93 million across three blockchains
The financial scale of the Ledger hardware wallet hack only became visible through the work of independent on-chain researchers. They tracked the movement of stolen funds through publicly available blockchain data and arrived at the following picture:
| Metric | Confirmed value |
|---|---|
| Estimated total damage | $86-93 million |
| Affected wallets | more than 300 |
| Affected blockchains | Bitcoin, Ethereum, Tron |
| Affected distribution channel | exclusively CryptoBilis (Malaysia) |
| Affected countries (initial reports) | Indonesia, Malaysia, Philippines |
The spread across three different blockchains suggests the attackers were able to capture a wide variety of wallet types and crypto assets — an indication that the hardware implant interfered deeply with the devices’ signing function rather than targeting a single coin type.
Important context: these figures do not come from Ledger itself, but from external on-chain analysts. They are based on blockchain transaction data and may still change as investigations continue.
Ledger’s response: sales halt across seven countries
Ledger responded with a gradual expansion of its warnings. Initially, the investigation focused on the three originally affected markets. On October 13, 2026, however, the company significantly broadened its sales-halt request to resellers and distributors, covering a total of seven countries and regions:
- Singapore
- Malaysia
- Indonesia
- Thailand
- Philippines
- Vietnam
- Hong Kong
This expansion shows that Ledger no longer considers the risk confined to a single reseller or three countries, but is preemptively placing the entire Southeast Asia and Hong Kong distribution region under heightened scrutiny. Resellers in these markets were asked to suspend sales of affected batches until further notice.
Notably, this caution appears to have had ripple effects in Europe as well. According to a report by Gate News, the German electronics retailer MediaMarkt halted sales of Ledger devices this week as a precaution — a move that shows how far the loss of trust from the Ledger hardware wallet hack is spreading internationally, even though the actual incident is geographically far removed.
What Ledger explicitly clarifies
Ledger repeatedly emphasizes one central point in its communications: the manipulation is, so far, confined exclusively to the batch of devices sold through CryptoBilis. Ledger’s own systems and the company’s direct sales channels are not affected based on current investigation findings.
In practical terms: anyone who bought their Ledger device directly from the official Ledger website or from an authorized retailer outside the named risk region is, as far as currently known, not part of this specific incident. Still, it is advisable to verify the origin of your own device if in doubt.
Why the Ledger hardware wallet hack differs from classic crypto thefts
Most crypto thefts in recent years have run through phishing websites, compromised smart contracts, or recovery phrases users inadvertently exposed. The Ledger hardware wallet hack follows a different pattern: so-called supply-chain manipulation.
Here, it’s not the software that gets attacked, but the physical hardware itself, before it even reaches the customer. A hardware implant installed somewhere in the manufacturing or distribution chain can undermine the fundamental security assumptions that the entire concept of “cold” offline storage is built on.
This is what makes the case particularly serious: for more background, see our beginner’s guide comparing hardware wallets. Hardware wallets are generally considered the safest way to store cryptocurrency, because private keys are never supposed to leave the device unencrypted. A tampered device undermines that promise at its root, regardless of how carefully the user behaves afterward.
What affected users should do now
Ledger has published clear recommendations for buyers who purchased their device through CryptoBilis. These can be summarized in four steps:
- Do not initialize unused devices. Anyone who still has an originally sealed device from CryptoBilis should under no circumstances set it up or generate a seed phrase on it.
- Move existing wallets. Users who have already set up their device should immediately move their existing balance to a new seed on a device sourced directly from Ledger.
- Contact official channels. Affected users should reach out exclusively through Ledger’s official support channels, not through links or contacts from social media or emails of unknown origin.
- Notify local law enforcement. Given this involves suspected criminal activity causing damage in the tens of millions, Ledger explicitly recommends involving the relevant local authorities.
Ledger will never ask for your 24-word recovery phrase over a phone call or a direct message. Any request of this kind is a clear scam attempt, regardless of the alleged sender.
Scammers are exploiting the incident
Alongside the actual security breach, Ledger is warning of a second danger: scammers deliberately exploiting the uncertainty surrounding the Ledger hardware wallet hack. Typical tactics in situations like this include fake support calls, phishing emails impersonating Ledger, or direct messages on social networks pretending to help “rescue” funds.
The underlying rule remains unchanged and universally valid: no legitimate Ledger employee, exchange, or reputable service provider will ever ask for your complete 24-word recovery phrase — not by phone, not by chat, not by email. Anyone receiving such a request should treat it as a scam attempt and not respond under any circumstances.
What this means for investors internationally
For users outside Southeast Asia, it is initially reassuring that the current Ledger hardware wallet hack appears to be geographically confined to that region and the CryptoBilis reseller. Anyone who bought their device through the official Ledger shop or an authorized retailer elsewhere is, based on what is currently known, not directly affected.
Still, the precautionary response from MediaMarkt shows that even established retailers outside the affected region are taking the risk seriously. This caution is understandable: as long as the exact spread of tampered batches hasn’t been fully clarified, caution remains the more rational strategy than premature reassurance.
For investors, this translates into one concrete takeaway: the origin of a hardware wallet is not a minor detail, but a central security factor. Devices should generally only be purchased through the manufacturer’s official website or explicitly authorized retailers, no matter how tempting a cheaper offer from a third-party seller might look.
Conclusion and next steps
The Ledger hardware wallet hack makes clear that cryptocurrency security doesn’t start with the software — it has to start with the hardware supply chain itself. An estimated damage of $86 to $93 million, spread across more than 300 wallets and three blockchains, shows the scale a single compromised distribution channel can reach, even when the manufacturer’s core systems themselves remain untouched.
Affected users who purchased their device through CryptoBilis should act immediately: do not activate unused devices, move existing balances to a new seed on a device sourced directly from Ledger, and report the incident to both Ledger and local authorities. All other users should take this opportunity to review their own purchase history, use only official distribution channels, and stay especially alert to scam attempts exploiting the current incident. The 24-word recovery phrase should never be shared in a phone call, a direct message, or an online form — that rule remains the single most effective protection against fraud in this space.
