Someone May Have Tampered With These Crypto Wallets Before They Were Sold
Ledger has asked a reseller called CryptoBilis to stop selling and shipping its wallets while it investigates possible tampering linked to emptied customer accounts.
The request came after users reported losing funds after setting up devices bought through CryptoBilis. Ledger has warned recent buyers from that seller and shared steps for checking if a device was tampered with, according to reporting by The Verge.
Reports put the losses at more than $86 million across hundreds of wallets. CoinDesk reported that figure on Oct. 9, 2026, and current reporting as of Oct. 10, 2026 continues to cite over $86 million. The number was described at the time as an analyst's claim based on tracking public payment records, not a Ledger-confirmed total, as noted by Yahoo Finance. Bloomberg had earlier on Oct. 9 described the incident as an estimated $70 million attack. The later figure replaces that early estimate.
The suspected cause is physical tampering before sale. Photos and videos shared by researchers appear to show a small extra circuit board hidden under the wallet screen. Think of it like a hidden camera watching the screen. It allegedly copies anything shown on the display, including the 24-word recovery phrase, the master password shown once during setup for backup. It then sends that information out over its own cellular connection, so the attacker can rebuild the password and take the funds later.
Ledger describes the case as a supply-chain attack focused in Southeast Asia and centered on the CryptoBilis distribution path, The Verge reported. There is no sign that Ledger's own systems were broken into. There is also no sign that devices bought directly from Ledger were affected. The pause request to CryptoBilis, detailed by The Defiant, covers both sales and shipments while the investigation continues.
The important detail is where the tap sits. It does not need to break the locked chip that holds keys or defeat software checks. Wallets use separate hardware to create backup codes and approve payments, so a hacked computer or phone cannot see what the user approves. An add-on that watches the screen cable gets around that protection without touching the codes themselves. It grabs the secret at the one moment it must appear in plain form for backup.
The broader context here is why its own cellular connection makes detection harder. A normal add-on that uses USB or Bluetooth would leave traces on the user's computer or phone. A board with its own cell signal does not. It can send the stolen phrase at once, quietly, from anywhere with coverage. The theft can then happen days or weeks later, after the device looked fine and the user thought setup was clean. That delay breaks the link users depend on to find the cause.
For buyers, the practical rule is simple. Buy direct, check the sealed packaging, and treat any third-party seller as untrusted until proven otherwise. App checks help, but they only verify software and chip state. They cannot see an extra listener attached to the screen cable. Physical checks still matter, including screen problems, added thickness, strange seams, or cellular activity that model should not have. Ledger's inspection guide is the correct first place to look for owners of possibly affected units.
In my view, this type of failure can be fixed with care rather than new invention. Supply-chain tampering is not new. Tighter seller controls, tracked serial numbers, sealed cases that show clear damage if opened, and clear advice never to set up large savings on hardware of unknown origin all lower the risk. None of that needs new cryptography. It needs careful handling across distribution. The long arc still favors owning your own hardware wallet, as long as buyers treat where they bought it as part of safety.
