Ledger Orders Reseller Pause as Display-Tapping Implant Drains Wallets
Ledger has asked reseller CryptoBilis to pause device sales and shipments while it investigates suspected hardware tampering tied to drained customer wallets.
The request follows user reports of accounts being emptied after setup on devices sourced through CryptoBilis. Ledger has warned recent buyers who purchased from that reseller and published guidance on how to check whether a device has been tampered with, according to reporting by The Verge.
Reports put the losses at more than $86 million across hundreds of wallets. CoinDesk reported that figure on Oct. 9, 2026, and current reporting as of Oct. 10, 2026 continues to cite over $86 million. The number was described at the time as an analyst's claim based on onchain tracking, not a Ledger-confirmed total, as noted by Yahoo Finance. Bloomberg had earlier on Oct. 9 described the incident as an estimated $70 million attack. The later figure supersedes that early estimate.
The suspected mechanism is physical interdiction in the supply chain. Photos and videos circulating among researchers appear to show a small additional circuit board implanted under the wallet screen. That board allegedly intercepts anything rendered on the display, including the 24-word recovery phrase presented during initial setup. Intercepted data is then transmitted out over an embedded SIM to the attacker, who can later reconstruct the seed and siphon funds.
Ledger characterizes the case as a supply-chain attack concentrated in Southeast Asia and centered on the CryptoBilis distribution path, The Verge reported. There is no indication that Ledger's own systems were compromised. There is also no indication that devices purchased directly from Ledger were affected. The pause request to CryptoBilis, detailed by The Defiant, covers both sales and shipments pending the outcome of the investigation.
For practitioners, the detail that matters is where the tap sits. The compromise does not require breaking the secure element, extracting keys through side channels, or subverting firmware signing. It sits on the trusted display path. Hardware wallets push seed generation and transaction verification to dedicated hardware precisely so a compromised host PC or phone cannot observe or alter what the user approves. An implant that watches the display ribbon bypasses that isolation without touching the cryptographic core. It captures the secret at the one moment it must be human-readable for backup.
The broader context here is that out-of-band exfiltration changes the detection calculus. A conventional implant that relies on the host USB or Bluetooth connection leaves artifacts in host logs, driver behavior, or RF patterns tied to user sessions. A board with its own cellular radio does not. It can forward a captured recovery phrase immediately, silently, and from anywhere with coverage. The theft can then occur days or weeks later, long after the device passed visual inspection and the user believed setup was clean. That delay severs the causal link users normally rely on to diagnose compromise.
Looking at what this means for procurement, the incident reinforces an old rule with a new urgency. Buy direct, verify tamper-evident packaging, and treat any third-party sourcing as untrusted until proven otherwise. Attestation checks in companion apps help, but they attest to firmware and secure-element state. They cannot see a passive listener soldered onto a display flex. Physical inspection remains relevant, particularly checking for display anomalies, added thickness, unexpected seams, or cellular behavior that should not exist in a given model. Ledger's inspection guidance is the correct first reference for owners of potentially affected units.
In this author's view, worth flagging is how recoverable the ecosystem is from this class of failure. Supply-chain interdiction is not new, and the defenses are understood even if they are unevenly deployed. Stricter authorized-reseller controls, serialized chain-of-custody, factory-sealed enclosures that are harder to rework without visible damage, and user education never to provision high-value seeds on hardware of uncertain provenance all reduce exposure. None of that requires new cryptography. It requires operational discipline across distribution, which is achievable once the incentive is clear. The long arc here still favors self-custody hardware, provided buyers treat provenance as part of the security model rather than an afterthought.
