Ledger has some reassuring news: its security chip was not hacked. People staring at empty wallets can take a moment to work out how pleased they should be.
On October 9, 2026, crypto was stolen from people who had bought devices through reseller CryptoBilis. Bitquery’s count, checked on October 15, puts the loss at roughly $102 million across 324 wallets. That is the researchers’ estimate; Ledger has not confirmed it.
Someone watched you enter the safe’s code
On October 13, Ledger explained the implant found in one victim’s device. An extra component inside the casing read the 24 recovery words from the screen during setup and sent them to the attackers over a mobile network. The security chip, device operating system and transaction signatures were left untouched.
Those words are the seed phrase. For a standard wallet without an additional passphrase, they let someone restore access on another device. The thief no longer needs your Ledger. They do not even have to press your buttons.
Imagine a safe with an excellent lock. Someone hides a camera beside the keypad and watches you enter the code. The lock passes every test. The contents of the safe somehow fail to appreciate the achievement.
Authentic device. Unexpected contents.
Ledger offers a device authenticity check. Its own hardware inspection guide states the limitation: the check cannot detect physical modifications, including spying implants, if the original security chip remains intact.
“A genuine Ledger” and “nobody added anything inside” are different claims. An engineer can understand the distinction. For a buyer who paid for protection and saw a successful check, learning the difference can cost a lifetime’s savings.
The next step has a certain elegance. The same guide provides pictures of the internals for inspection, alongside a warning that opening the device can damage it. You bought a wallet to spend less time worrying about security. Now you have a reason to study circuit boards.
The black box had company
Blaming a random bargain seller is awkward here: CryptoBilis appeared in Ledger’s official reseller directory. Investigators are still establishing who altered the devices and where it happened.
This is where the promise of peace of mind starts to crack. The buyer is asked to trust the manufacturer, seller, delivery process and contents of the box. Then it turns out the check answers only part of the question. The remaining trust suddenly becomes the buyer’s personal problem.
In this case, the attackers did not even need to change the device’s software. They added their own observer. There was room for a thief inside a genuine device.
This is not a confirmed breach of the Ledger Live app, nor evidence that every Ledger is compromised. In its October 14 update, Ledger said inspections of German retail and distributor stock found no tampering; it had not yet received the suspect devices shown online. That limits what we can say about the scale. It does not make the implant already found any less real.
What buyers should do now
For CryptoBilis customers, Ledger’s advice is straightforward: do not set up an unused device; if you have used one, move funds to a new wallet set up on a trusted device with a new seed phrase. Taking the old phrase with you does not erase a copy the thief may already hold. Do not enter it into a website offering a “security check.”
The card stores. You encrypt.
A Mitilena card is a vault for data you encrypt yourself. You choose a password, use it to encrypt your data, and save the encrypted data to the card.
You can read a record stored in the standard NFC format with an ordinary app such as NFC Tools. Reading the card does not decrypt the data. That is the idea: you do the encrypting, and the card stores what you put on it.