In this article · 9 sections
- 01The short answer
- 02What happened with CryptoBilis, day by day
- 03Who is affected
- 04Why the Genuine Check could not catch it
- 05Where to buy, from safest to riskiest
- 06Fake 'official' Ledger pages are in the search results
- 07The 6 checks to run when the box arrives
- 08Already own a Ledger bought from a reseller?
- 09Is a hardware wallet still worth it?
Buy a Ledger from Ledger's own store, typed into the address bar yourself, and run the setup checks below the day it arrives. That advice was always in the manual; in October 2026 it stopped being theoretical. Devices sold by CryptoBilis, an authorised Ledger reseller in Southeast Asia, contained a small implant that read the 24-word recovery phrase from the screen during setup and sent it to an attacker over a mobile network. Ledger says its own systems and direct sales were not affected. If you bought from CryptoBilis, treat your recovery phrase as known to someone else and move your funds. If you bought elsewhere, read the section on what you can and cannot check yourself.
The short answer
The attack did not break Ledger's secure chip or its software. It added hardware inside the case, between the factory and the buyer, and simply watched the screen while the owner wrote down the recovery phrase. That is why the fix is about where the device comes from, not about a setting you can change.
Three rules cover almost every case: buy from the manufacturer's own store; never accept a device that arrives with a recovery phrase or PIN already set; and if there is any doubt about a device's history, create a new recovery phrase on a device you trust and move everything to it. Moving funds costs a few network fees. Losing a phrase costs everything.
What happened with CryptoBilis, day by day
Everything below comes from Ledger's public statements as reported by the press, or from named investigators. The loss figures are on-chain estimates by third parties; Ledger has not confirmed a total.
| Date | What was reported | Source |
|---|---|---|
| 9 Oct | Ledger says it is investigating fund losses among users in Southeast Asia who bought through CryptoBilis, asks the reseller to pause all Ledger sales and shipments, and tells buyers from the last 90 days not to set up their device | The Block; Finance Magnates |
| 9 Oct | On-chain investigators estimate losses above $72 million, then above $86 million, across Bitcoin, Ethereum and Tron. The cause is still unknown at this stage | The Block; Finance Magnates |
| 10 Oct | Ledger confirms that one affected user's device contained an unauthorised hardware implant, and says it has no evidence its own systems were compromised | Crypto Briefing |
| 11–12 Oct | Estimates reach up to $93.2 million across 311 to 315 wallets, most of it USDT on Tron. Tether freezes about $10 million linked to the thefts | Crypto Briefing; CoinDesk |
| 13 Oct | Ledger explains the implant: it sat inside the case, read the 24 words from the screen during setup, decoded them and sent them over LTE using an eSIM. It did not modify the secure element or the operating system, and did not alter transactions | CoinDesk |
| 13 Oct | Ledger says every confirmed loss so far involves a device sold by CryptoBilis. Separately, MediaMarkt Saturn stopped selling Ledger devices after a customer in Germany reported an implant | CoinDesk |
Sources: The Block, 9 Oct 2026 · Finance Magnates, 9 Oct 2026 · Crypto Briefing, 11 Oct 2026 · CoinDesk, 13 Oct 2026
Who is affected
CryptoBilis sold Ledger devices in Indonesia, Malaysia and the Philippines. Ledger's advice targets anyone who bought from it in the 90 days before 9 October 2026, but if you bought from CryptoBilis at any point and still use that device, the cautious reading is the same: the phrase may be exposed.
Two other reports are circulating and are not, as of 13 October, confirmed by Ledger as linked: Mark Karpelès, the former Mt. Gox chief executive, says he found an implant in a Ledger Flex bought at Singapore's airport, and a customer in Germany reported one in a device bought at MediaMarkt. Ledger's CTO Charles Guillemet said the company is reviewing its reseller controls and anti-tamper protections. We will update this page as the investigation moves.
Why the Genuine Check could not catch it
Ledger's Genuine Check is a cryptographic test: during setup, the Ledger Wallet app sends a challenge, and the secure element answers with a signature that only a chip provisioned at Ledger's factory can produce. It proves the chip is Ledger's and the firmware is genuine. It is worth running every time.
It cannot see a component soldered next to that chip. The CryptoBilis implant left the chip and the firmware untouched and only read what the screen displayed, so a device could pass the check and still leak its phrase. Ledger's own buying guide says as much: the check cannot detect all physical modifications, which is why the purchase channel matters.
Sources: Ledger Academy: best practices to securely buy a Ledger signer (updated 18 Sep 2026) · Ledger support: Genuine Check
Get the Exchange Safety Checklist
Plus an alert whenever a top exchange changes its proof-of-reserves, licensing or security status. No spam, unsubscribe anytime.
We store only your email to send the checklist and safety alerts. See our privacy policy.
Where to buy, from safest to riskiest
CryptoBilis was an authorised reseller, so 'authorised' is not a guarantee. Fewer hands between the factory and you means fewer chances for tampering.
| Channel | Risk | What to check |
|---|---|---|
| Ledger's own store (shop.ledger.com, typed yourself) | Lowest | The address in the bar, and an intact package on arrival |
| Ledger's official storefront on a marketplace | Low | 'Sold by' must read Ledger, not a third-party seller |
| Authorised reseller listed on Ledger's reseller page | Moderate | That the shop appears on Ledger's own list for your country |
| Third-party marketplace seller | High | Avoid. Ledger asks for extra verification on these |
| Second-hand, auction, 'opened box', gift from a stranger | Do not use | No check you can run at home rules out tampering |
Sources: Ledger: official reseller list
Fake 'official' Ledger pages are in the search results
When we searched for Ledger's setup instructions on 13 October 2026, several results imitating ledger.com/start were hosted on teachable.com, daftpage.com and sites.google.com. They look like setup guides and exist to collect recovery phrases or push a fake app. Ledger's only official setup and download pages sit on ledger.com. Type the address yourself, and install Ledger Wallet only from ledger.com or the official app stores.
The 6 checks to run when the box arrives
These come from Ledger's own buying guide. None of them detects an implant, but together they stop the far more common scams: pre-set phrases, fake apps and swapped devices.
- The packaging is intact. If it looks opened or re-sealed, do not use the device and contact Ledger support
- No recovery phrase is included, and no PIN is already set. A genuine device creates its own phrase during setup
- You write the 24 words only on the paper sheet or your own backup, never into a phone, computer, app or website
- Ledger Wallet comes from ledger.com or the official app store, not from a link in an email or a search ad
- The Genuine Check passes in Ledger Wallet
- You ignore any 'replacement device' you did not order: Ledger does not send unsolicited replacements
Sources: Ledger Academy: best practices to securely buy a Ledger signer
Already own a Ledger bought from a reseller?
If it came from CryptoBilis, follow Ledger's instructions: do not set up a device you have not used yet, and if you did use one, create a new recovery phrase on a device bought from a trusted channel and send everything to the new addresses. Do not type your old phrase into the new device: the old phrase is the thing that leaked.
If it came from another reseller, Ledger says it has not verified any theft involving a device bought elsewhere as of 13 October 2026. The decision is yours. If you have no doubts about the channel, keep using it and watch Ledger's updates. If you do, the same migration is cheap insurance. We do not recommend opening the case to look for components: it can void the warranty, and you would need a reference to compare against.
Is a hardware wallet still worth it?
Yes, with clear eyes. This attack needed physical access to devices before sale, in one distribution channel. The losses that hit far more people in 2026 happened elsewhere: the Bitget exchange lost about $387.5 million from its hot wallets on 24 September, and a firmware bug in Coldcard wallets that made some seeds guessable was exploited in July. Each case teaches the same habit: know where your keys were created, and be ready to move to fresh ones.
For larger amounts, a 2-of-3 multisig built from devices of different brands, bought through different channels, means one compromised device cannot move funds on its own. It is more work, so it is worth it only above the amount you could not afford to lose.
Next step
Buy from the source
If you want a Ledger, buy it from Ledger's own store and run the checks above on arrival. The link below goes to Ledger's official shop.
Sponsored · affiliate link. We may earn a commission; it never changes our rankings or this article.
Keep reading
Quick answers
Was Ledger hacked?
Not according to Ledger or the evidence published so far. Ledger says the implant did not modify its secure element or operating system and that its systems and direct sales were not compromised. The attack was a physical modification of devices sold through one reseller, CryptoBilis.
Does the Genuine Check detect implants?
No. It proves the secure element and firmware are genuine Ledger parts. An added component that only reads the screen leaves both untouched, so the device still passes. Run the check anyway: it catches counterfeit devices and fake apps.
Is it safe to buy a Ledger on Amazon?
Only from Ledger's official storefront or an authorised reseller, with 'Sold by' checked before you pay. Ledger's own store has the fewest intermediaries and is the option we recommend.
I bought from CryptoBilis but never set the device up. What now?
Do not set it up. Ledger asked recent CryptoBilis buyers not to initialise their devices; contact Ledger support for next steps.