How can you save your hardware wallet?
Ledger has suffered the biggest security incident in its history, with losses of about $90 million. That figure could still rise.
1⃣ Sold to you after a reseller “blesses” it
Ledger devices sold by Southeast Asian authorized reseller CryptoBilis are suspected of having been implanted with spyware modules. Ledger has officially asked the reseller to suspend sales and advised users who bought devices through this channel in the past 90 days to transfer their assets immediately.
People who still buy hardware wallets from platforms like JD.com or Taobao are just paying for an expensive lesson.
2⃣ The biggest victim: 80 BTC wiped out
According to monitoring by Lookonchain, a user bought the dip in June, purchasing 80 BTC at $65,000 each (an investment of about $5.2 million, which at one point showed an unrealized gain of $1.38 million). A week ago, they bought a Ledger from CryptoBilis and transferred all their coins to it, intending to hold for the long term. Then came the reversal: all 80 BTC are now gone.
Another user, whose address is TY24Ya, bought a Ledger device from CryptoBillis three weeks ago and deposited 7 million USDT into it. Those funds have now all been stolen.
3⃣ Generating your recovery phrase offline won’t help either
Mark Karpelès, former CEO of Mt. Gox, took apart a Ledger and shared what he found:
The compromised device came from Malaysia. Its shrink-wrap packaging was intact, and nothing looked unusual to the naked eye.
The spyware module was hidden behind the screen’s cushioning pad—a combination of an LTE communications component, an antenna, an eSIM, and a microcontroller connected to the SPI bus.
The moment you set up your recovery phrase on the screen, the module reads it and sends it out. The attackers then just have to monitor your address and transfer any large deposits as soon as they arrive.
4⃣ Ledger’s troubled history
In 2020, the email addresses of more than 1 million customers were leaked.
In 2023, the Connect Kit supply chain was attacked.
This April, a fake app scammed users out of $9.5 million.
This time, the $90 million in losses is nearly 10 times the amount involved in the previous biggest case.
5⃣ Four ironclad rules
a) Check immediately: If you bought a Ledger from CryptoBilis or any unofficial channel in the past 90 days, don’t hesitate—move your assets to a new wallet right away.
b) Buy only from the official website. No resellers, no secondhand devices, and no “200 yuan cheaper” bargains.
c) Always inspect the box when unboxing: make sure the tamper-evident seal is intact, and run Ledger Live’s authenticity verification (genuine check).
CZ’s advice last night: let a new wallet sit for a few weeks before transferring large amounts, and keep an eye on security news in the meantime.
d) Don’t put all your eggs in one basket: putting all 80 BTC on a single device is a textbook example of what not to do. Split large holdings across multisig setups or multiple wallets. Write down your recovery phrase by hand and store it offline—never photograph it, connect it to the internet, or tell anyone.
The hackers have already started laundering the money: $1.07 million in ETH was transferred to Tornado Cash, and some of the funds flowed into Binance hot wallets.
In the first half of 2026, there were 182 publicly reported security incidents in the crypto industry, with losses of about $956 million.
But according to SlowMist, funds were recovered or frozen in only 18 incidents, totaling about $118 million—12.3% of the overall losses. Nearly 90% of the stolen funds have vanished without a trace.
Why can’t they be recovered?
Crypto money laundering has become a case of “the biter bit”—the tables have completely turned.
About $974 million flowed into privacy protocols in the first half of the year, with Tornado Cash alone accounting for 71%. Once money enters a mixer, recovery is virtually impossible.
Tether has already frozen some USDT linked to the incident. CZ personally called on the entire industry to help recover the funds last night, but it hasn’t made much difference.
The hackers’ wallets still hold about 10.9 million USDT. They have already transferred 430.2 ETH to Tornado Cash and converted some USDT to USDD to evade freezing.
It seems unlikely that much of the money stolen in this Ledger incident will be recovered!
Ledger has suffered the biggest security incident in its history, with losses of about $90 million. That figure could still rise.
1⃣ Sold to you after a reseller “blesses” it
Ledger devices sold by Southeast Asian authorized reseller CryptoBilis are suspected of having been implanted with spyware modules. Ledger has officially asked the reseller to suspend sales and advised users who bought devices through this channel in the past 90 days to transfer their assets immediately.
People who still buy hardware wallets from platforms like JD.com or Taobao are just paying for an expensive lesson.
2⃣ The biggest victim: 80 BTC wiped out
According to monitoring by Lookonchain, a user bought the dip in June, purchasing 80 BTC at $65,000 each (an investment of about $5.2 million, which at one point showed an unrealized gain of $1.38 million). A week ago, they bought a Ledger from CryptoBilis and transferred all their coins to it, intending to hold for the long term. Then came the reversal: all 80 BTC are now gone.
Another user, whose address is TY24Ya, bought a Ledger device from CryptoBillis three weeks ago and deposited 7 million USDT into it. Those funds have now all been stolen.
3⃣ Generating your recovery phrase offline won’t help either
Mark Karpelès, former CEO of Mt. Gox, took apart a Ledger and shared what he found:
The compromised device came from Malaysia. Its shrink-wrap packaging was intact, and nothing looked unusual to the naked eye.
The spyware module was hidden behind the screen’s cushioning pad—a combination of an LTE communications component, an antenna, an eSIM, and a microcontroller connected to the SPI bus.
The moment you set up your recovery phrase on the screen, the module reads it and sends it out. The attackers then just have to monitor your address and transfer any large deposits as soon as they arrive.
4⃣ Ledger’s troubled history
In 2020, the email addresses of more than 1 million customers were leaked.
In 2023, the Connect Kit supply chain was attacked.
This April, a fake app scammed users out of $9.5 million.
This time, the $90 million in losses is nearly 10 times the amount involved in the previous biggest case.
5⃣ Four ironclad rules
a) Check immediately: If you bought a Ledger from CryptoBilis or any unofficial channel in the past 90 days, don’t hesitate—move your assets to a new wallet right away.
b) Buy only from the official website. No resellers, no secondhand devices, and no “200 yuan cheaper” bargains.
c) Always inspect the box when unboxing: make sure the tamper-evident seal is intact, and run Ledger Live’s authenticity verification (genuine check).
CZ’s advice last night: let a new wallet sit for a few weeks before transferring large amounts, and keep an eye on security news in the meantime.
d) Don’t put all your eggs in one basket: putting all 80 BTC on a single device is a textbook example of what not to do. Split large holdings across multisig setups or multiple wallets. Write down your recovery phrase by hand and store it offline—never photograph it, connect it to the internet, or tell anyone.
The hackers have already started laundering the money: $1.07 million in ETH was transferred to Tornado Cash, and some of the funds flowed into Binance hot wallets.
In the first half of 2026, there were 182 publicly reported security incidents in the crypto industry, with losses of about $956 million.
But according to SlowMist, funds were recovered or frozen in only 18 incidents, totaling about $118 million—12.3% of the overall losses. Nearly 90% of the stolen funds have vanished without a trace.
Why can’t they be recovered?
Crypto money laundering has become a case of “the biter bit”—the tables have completely turned.
About $974 million flowed into privacy protocols in the first half of the year, with Tornado Cash alone accounting for 71%. Once money enters a mixer, recovery is virtually impossible.
Tether has already frozen some USDT linked to the incident. CZ personally called on the entire industry to help recover the funds last night, but it hasn’t made much difference.
The hackers’ wallets still hold about 10.9 million USDT. They have already transferred 430.2 ETH to Tornado Cash and converted some USDT to USDD to evade freezing.
It seems unlikely that much of the money stolen in this Ledger incident will be recovered!