Users of hardware cryptocurrency wallets are reportedly being targeted through a sophisticated supply chain attack that involves a tiny, unauthorized chip implanted in the devices. At least $86 million has been stolen so far, with estimates suggesting the total could exceed $100 million. The incident, first reported on October 9th, 2026, appears to have originated from devices sold through the Southeast Asia reseller CryptoBilis.
Ledger, a prominent hardware wallet manufacturer, confirmed that an investigation into the draining incident found "one of the impacted users' devices contained an unauthorised hardware implant." All confirmed cases linked to this event have involved devices purchased from CryptoBilis, which has since halted all sales pending the investigation. Ledger is cooperating with authorities to apprehend those responsible.
Analysis of an affected device suggests the implant was cleverly concealed, with the battery removed to make space for the component, which was soldered behind the screen's padding. This implant reportedly intercepts information displayed on the screen, bypassing the device's standard hardware tampering detection mechanisms. Ledger's own integrity checks cannot detect such unauthorized physical modifications if the secure element remains intact.
To combat such threats, Ledger provides disassembly images of its hardware wallets, allowing users to inspect for any tampering. However, the effectiveness of this measure against sophisticated implants like the one described is questionable. The company also emphasizes that its direct sales channels remain unaffected.
In light of this incident, Ledger is reminding authorized resellers and distributors to source products exclusively through official channels and to never resell returned items. Users are strongly advised against purchasing from unauthorized resellers due to the elevated risk of acquiring counterfeit or modified devices. Ledger stated that its systems and direct sales channels remain unaffected and that it is continuously reviewing and strengthening its distribution and anti-tamper processes.
The broader implications of this attack highlight the growing risks associated with supply chain vulnerabilities. Security experts have pointed to software supply chain failures as a significant threat, and similar concerns have been raised in other hardware sectors. The incident underscores the advice to procure goods as directly as possible from the source, particularly when dealing with assets of high value.
For affected customers, Ledger advises moving their assets to a new seed on a device obtained directly from Ledger. They also recommend contacting Ledger Support through official channels and filing complaints with local law enforcement. The company has stressed that scammers may attempt to exploit this situation and users should rely solely on official Ledger communication channels, as the company will never request a recovery phrase.