An ongoing investigation has found that counterfeit or tampered Ledger hardware wallets, sold through third-party resellers like Cryptobilis in Southeast Asia and elsewhere, contained hidden eSIM and LTE chips capable of capturing users' recovery phrases. Researchers say more than $93 million has already been stolen from affected users, while wallets purchased directly from Ledger remain unaffected. Cryptobilis has halted sales of all hardware wallet brands while the investigation continues.
tomshardware.com
· 2026-10-13
Security researchers at Tibane Labs found counterfeit or tampered Ledger Nano X hardware wallets fitted with an extra chip that reads the device's screen output via electromagnetic leakage, plus a hidden LTE modem, eSIM and antenna powered by the wallet's own battery. This setup lets attackers capture a user's seed phrase as it's displayed and transmit it over mobile networks, despite the wallet's Secure Element chip remaining untouched. Ledger has acknowledged at least one customer suffered losses from a manipulated device, with total losses across victims estimated near $100 million.
heise.de
· 2026-10-13
Ledger has confirmed that at least one of its hardware wallets, sold through Malaysia-based reseller CryptoBilis, contained an unauthorized hardware implant that drained users' cryptocurrency funds. The company asked CryptoBilis to halt sales and shipments on October 9, and a day later confirmed the tampering, saying it is contacting affected users and working with authorities to find those responsible. Ledger says all reported fund losses trace back to devices from this one reseller and describes the scale of the breach as limited.
bleepingcomputer.com
· 2026-10-12
Ledger said its October 10 investigation into reported crypto thefts tied to Southeast Asian reseller CryptoBilis uncovered an unauthorized hardware implant inside one affected customer's wallet. CryptoBilis has suspended sales of all hardware wallets while Ledger works with authorities and contacts other impacted users. Researcher Mark Karpelès separately reported finding suspicious electronics behind the screen of a Ledger Nano X in Malaysia, while blockchain analytics firm Bitquery estimated losses of $92.9 million across 311 wallets, a figure Ledger has not independently confirmed.
crypto.news
· 2026-10-12
Former Mt. Gox CEO Mark Karpelès has spent nearly a month publicly posting claims that he found hidden 'spy implants' inside Ledger crypto hardware wallets. He has not yet provided full technical documentation of the alleged findings in the reporting available.
gizmodo.com
· 2026-10-12
Users of Ledger crypto wallets purchased through reseller CryptoBillis have reported drained accounts, with reports citing over $86 million stolen from hundreds of wallets. Photos shared on social media appear to show a hidden circuit board implanted under the wallet's screen that captures the seed passphrase and transmits it via an embedded SIM card. Ledger has asked CryptoBillis to pause all sales while it investigates, and says there is no evidence its own systems or directly purchased wallets were compromised.
theverge.com
· 2026-10-10
Ledger says it is investigating reports of stolen funds from users in Southeast Asia who bought devices through reseller CryptoBilis, and has asked the reseller to pause all sales and shipments pending results. The company told buyers from the past 90 days not to set up their devices, and advised those who already have to transfer assets to a new Ledger with a fresh recovery phrase. On-chain researchers Specter and tanuki42 have separately traced victim wallets to suspected theft addresses, estimating losses above $86 million and $72 million respectively, though Ledger has not confirmed any figure, victim count or cause.
techreport.com
· 2026-10-10
Cloudflare released Security-Audit-Skill, a coding-agent tool that runs a six-phase security audit: mapping a codebase's architecture and attack surface, assigning isolated 'hunter' agents to search for vulnerabilities against a coverage ledger, validating candidates with skeptical verifier agents, and producing structured reports categorized as confirmed, needs_validation, or rejected. It served as the original single-repo prototype that Cloudflare later expanded into its larger, fleet-wide vulnerability discovery harness.
github.com
· 2026-09-17
Ian Rogers, who previously built Beats Music, helped launch Apple Music, and later worked at LVMH, has taken on the role of chief human agency officer at Ledger, a crypto security startup valued at $1.5 billion. Ledger uses secure hardware chips, similar to those found in credit cards, to protect digital assets like Bitcoin from theft or loss. Rogers is now working remotely from rural Italy, shaping the company's security and AI strategy.
entrepreneur.com
· 2026-09-10
GoKawiil