The Ledger That Passed Every Check and Still Leaked Its 24 Words

Crypto

The Ledger That Passed Every Check and Still Leaked Its 24 Words

中文版 →

In early October, people who had bought Ledger hardware wallets from a Southeast Asian reseller called CryptoBilis woke up to empty wallets. Someone had hidden a tiny extra circuit board inside the devices, and it quietly sent each owner’s secret words to the thieves.

The draining happened on October 9, 2026. Ledger confirmed the hidden board the next day. By October 12, researchers who follow the money on the blockchain counted roughly a hundred million dollars gone.

I keep most of my own crypto on hardware wallets, so this one landed close to home. What bothers me is not the amount. It’s that these were real Ledger devices that passed Ledger’s own “genuine” check. If your idea of safety is “the app said it was genuine”, this is for you, even if you never heard of CryptoBilis.

To be clear up front: this is not investment advice. It’s my own reading of public reports up to October 16, and I’ve tried to keep “Ledger confirmed” separate from “researchers found”.

How much was taken, and when we found out

The first numbers came on October 9, within hours, from independent on-chain researchers (people who trace transfers in public blockchain data). The counts grew over the next three days as more stolen wallets turned up.

When (2026)AmountWho counted
Oct 9, morningmore than $72Mresearcher tanuki42
Oct 9, midday$86M+researcher Specter
Oct 9, eveningabout $91M (“a floor”)Alex Thorn, Galaxy Research
Oct 9, evening$93.4MYFarmX
Oct 11$93.2MBitquery
Oct 12$102.0MBitquery
Oct 12$103.4MYFarmX

The October 12 jump is nine TRON wallets both firms had missed. The “$86 million” in most headlines is Specter’s first count, repeated.

Ledger has never published a total. On October 13 it said the figures “come from third parties and Ledger has not fully verified them.” So every number above is a researcher’s count, not an official one.

You’ll also see “300 wallets” here and “500 addresses” there. An address is not a victim: one person can own several, so nobody has said how many people lost money. Ledger only says “the volume of impacted devices is limited.”

Which countries were hit

CryptoBilis is based in Petaling Jaya, Malaysia, and sold Ledger devices in Malaysia, Indonesia and the Philippines. Those are the three countries named in its own sales-pause notice.

Ledger says the confirmed losses are in Southeast Asia only. On October 14 it said: “We have not verified a drain linked to a device bought elsewhere.” Nobody, not Ledger, not the researchers, not the press, has published a count of victims per country.

But researchers have found implanted devices, with no money lost, from other sellers elsewhere:

  • Germany: two Nano X units from MediaMarkt stores, caught by a buyer before setup.
  • Singapore: a Ledger Flex bought at the airport from a retailer called Metapod.
  • Thailand: a Nano X bought from a Lazada seller back in August 2025.
  • Japan: marketplace purchases, one of them shipped from Malaysia.

On October 13, according to press reports, Ledger asked resellers in seven markets (Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong) to stop selling and pull stock.

What Ledger did, day by day

  • Oct 9: First statement on X: investigating losses among CryptoBilis buyers, reseller asked to pause sales, recent buyers told not to set up and to move funds to a new device with a new recovery phrase.
  • Oct 10: Ledger confirmed that “one of the impacted users’ devices contained an unauthorized hardware implant.” CryptoBilis stopped selling all hardware wallets.
  • Oct 11: “72 hour update”: working with authorities; all confirmed cases are CryptoBilis devices; Ledger’s own systems and direct sales unaffected.
  • Oct 13: Its security team explained the implant (below). The CTO and CEO said they are reviewing reseller controls and anti-tamper protection, and don’t yet know where in the delivery chain the tampering happened. Seven Asian markets paused; MediaMarkt stopped sales “with Ledger’s alignment.”
  • Oct 15: Announced the Atom, a device due mid-2027 with sensors that notice if the case is opened, which a spokesperson said “will explicitly block the screen reader implants.”

Timeline last updated 16 Oct 2026; I’ll add to it as Ledger says more.

What Ledger has not done so far: there is no refund or replacement programme (CoinDesk reports it “has no plans for trade-in programs” for affected customers), no firmware or Ledger Live change announced in response, and no official loss total.

How the trick works, in plain words

Two terms first. Your recovery phrase is the 24 words a wallet shows you once, at setup; anyone with them can rebuild your wallet anywhere. The Secure Element is the locked chip that holds the keys.

The thieves didn’t break that chip. They went around it.

Picture a genuine safe with a tiny camera glued inside the door. The lock and steel are real, but the first time you set the combination, the camera films it and texts it out.

That’s roughly what Ledger confirmed on October 13. The implant “sits inside the enclosure and reads the data shown on the screen.” It sleeps until setup. When the 24 words appear, it reads them and sends them out over mobile data through its own eSIM (a built-in SIM card, so the implant has its own mobile data and never needs your Wi-Fi). Ledger says it does not touch the Secure Element or Ledger’s software, and does not change your transactions.

Researchers found, by opening devices, a small board under the screen with its own chip, antenna, mobile radio and SIM.

Then the thieves waited. They collected phrases for months, ran test transfers from late September, and on the morning of October 9 emptied hundreds of wallets in batches, minutes apart.

Two questions people keep asking:

  • Does my PIN help? No. It only unlocks that one device; with your 24 words, a thief rebuilds the wallet elsewhere.
  • What about a passphrase (an optional extra “25th word”)? Ledger hasn’t said. One security researcher thinks a passphrase typed on the same compromised device would show on the same screen and be captured too, though they label that untested.

Why Ledger’s “Genuine Check” said everything was fine

When you connect a Ledger to the Ledger Live app, it runs a Genuine Check: Ledger’s server sends a random question, and the Secure Element answers with a secret only real Ledger chips hold. Right answer, device declared genuine.

So the check proves the chip is real. It does not prove nothing was added next to it. And in this attack, the chip is real and untouched.

Ledger says this itself, on its security team’s own threat-model page: the check “cannot detect unauthorized physical modifications to the hardware” and “cannot verify the device’s physical supply chain history.” That page predates this incident.

Researchers saw it happen: Mark Karpelès says his implanted device “passed Ledger’s Genuine Check”, and Joe Grand’s earlier one from Thailand passed too. One caveat: Ledger has not said whether the victims’ own devices passed. By design, though, nothing in the check would catch them.

How to check your device and protect yourself

Ledger’s own advice, in its words where I could find them:

  • “If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up.” (Ledger’s CTO, Oct 13)
  • “If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.” Ledger also says the new device should come from Ledger directly.
  • Never type your recovery phrase into any website, app or form, and never restore it on a CryptoBilis-sold device.
  • “Ledger will never call you, DM you, or ask for your 24-word recovery phrase.” Expect scammers to pose as Ledger support right now.
  • If you lost money, contact Ledger Support through official channels and report it to your local police. “If you lost funds, coordinate with law enforcement before opening the signer.”
  • If you plan to open a device to look inside, back up your recovery phrase first, because opening it can damage it.

The honest limits of checking at home:

  • Shrink wrap and seals prove nothing. The newest implants arrived in intact retail wrap.
  • Weighing the device isn’t endorsed by Ledger or any researcher.
  • Opening it is the only sure way to see an implant. Karpelès says owners can do it on a Nano X, but it can break the device.

The key point: a new device alone doesn’t fix a leaked phrase. You need a brand-new recovery phrase made on a trusted device, then move your coins to it. Typing the old 24 words into a new Ledger carries the leak along.

This is not the old “pre-filled card” scam. There, the box comes with a recovery sheet already filled in, and Ledger’s rule catches it: “A legitimate Ledger device never comes with a recovery phrase or PIN code pre-configured.” Here, everything looks factory-fresh, you make your own phrase correctly, and the hardware leaks it anyway.

If you bought from CryptoBilis in 2026

  • Not set up yet? Don’t. Contact Ledger Support.
  • Already set up? Get a new device from Ledger, create a new phrase on it, and move everything across now.
  • Lost funds? Police report and Ledger Support first, before you open or ship the device.

If you bought anywhere else

  • Ledger says no drain has been confirmed outside CryptoBilis, but implanted units have turned up from other sellers.
  • Bought from a marketplace, a third-party shop, or second-hand? Treat it with suspicion. The cautious move is a fresh phrase on a device bought direct from ledger.com.
  • Next time, buy direct. Ledger’s own buying guide says “purchasing from Ledger or Authorised Resellers is recommended”, and this week showed even authorised resellers can be a weak link.

What the community did

Following the money. Researchers tanuki42 and Specter posted the first stolen-wallet lists on October 9. Galaxy Research, YFarmX and Bitquery built full counts from there. Bitquery keeps a live investigation page mapping where the money went; YFarmX published dated counts too.

A partial freeze. On October 9 Tether (the company behind the USDT stablecoin) blacklisted thief addresses and kept about $10 million frozen.

Opening the boxes. Mark Karpelès (ex-Mt. Gox CEO) and his firm Tibane Labs took devices apart, published photos and described three generations of the implant. Hardware hacker Joe Grand had found an earlier one in a second-hand Thai Nano X and reported it to Ledger in March 2026; he says Ledger later told him it found “no evidence of theft.”

Other companies moved. Trezor dropped CryptoBilis and will cut its reseller network from January 2027. OneKey cut ties and offers free replacements for its devices bought there this year. MediaMarkt pulled Ledger stock. CryptoBilis paused all hardware-wallet sales in its three countries and closed its shops, calling it a “preventive measure aimed at protecting its customers.”

About CryptoBilis. The company changed hands in 2026: its founders say they handed it over in March, and company filings shared on X show all its shares moving to a new owner in August. Binance founder CZ alleged that the attackers bought the reseller; that is an allegation, not a finding. Zero Day reports there is “no evidence linking anyone at CryptoBilis to the implants or heists”, and Ledger has not accused the company.

What this changes

For years the advice was simple: get a cold wallet and you’re safe. A cold wallet is only as safe as the path it took to reach your hands. The chip did its job; the box around it was the weak spot. Where you buy now matters as much as what you buy.

I’ll keep updating the timeline above as Ledger publishes more. For risks you can see on the blockchain, such as frozen addresses, extra signers and forgotten approvals, MuWatch (my app, for Mac) checks them for you: media-mu.com/muwatch.html. To be honest about its limits: it watches your wallets on-chain, and it cannot see inside a hardware device.

Sources

GFL

Related Posts