Ledger / CryptoBilis supply-chain implant (2026)

Physical supply-chain attack on Ledger signers sold by the Southeast Asian reseller CryptoBilis (Indonesia, Malaysia, Philippines). Ledger's Donjon team found an unauthorized LTE/eSIM implant soldered inside the enclosure: during setup it reads the 24-word recovery phrase off the screen and transmits it over the mobile network. It does not modify the Secure Element, Ledger OS, transactions or signatures. Ledger says its software, systems and services were not breached. Not related to the 2020 data leak or the 2023 Connect Kit incident. On 9 Oct 2026 (from 05:07 UTC) one actor drained hundreds of wallets on 6 chains within an hour, after two weeks of test runs; on Bitcoin, 111 wallets were swept in a single block at 05:54 UTC.

Losses (not confirmed by Ledger, which says it has not verified the number of victims or the total): Bitquery (13 Oct) counts $102.0M from 324 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain, Polygon, incl. 203.8 BTC (~$16.8M at $82,300) from 122 Bitcoin wallets, sitting unmoved in two drain addresses; most of the rest was USDT on TRON. Earlier: >$86M (on-chain investigator Specter, 10 public addresses); ~$91M / 213.42 BTC (Alex Thorn, includes a third BTC address Bitquery treats as separate). Tether froze $10.0M USDT; ~6,840 ETH laundered via Tornado Cash and Zcash; ~$84M still traceable on-chain as of 13 Oct 09:24 UTC. Status: ongoing. Ledger (13 Oct) asked resellers in Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia and Hong Kong to pull devices; all confirmed drains involve CryptoBilis units. Unconfirmed: MediaMarkt Saturn halted Ledger sales in Europe after a tampered unit in Germany (no loss reported); Mark Karpelès reported an implant in a Ledger Flex bought at Singapore airport — Ledger has not linked it.