Summary: Ledger users lost over $86 million to theft. The devices were purchased from Southeast Asian reseller CryptoBilis, and the problem lay in the delivery process, not the chip.
On the evening of October 9, on-chain investigator Specter sounded the alarm on X: hundreds of wallets across the Ethereum, Tron, and Bitcoin networks had been drained in a short period, with total losses exceeding $86 million.
All the stolen wallets had one thing in common: their users had purchased Ledger hardware wallets from Southeast Asian reseller CryptoBilis within the past 90 days.
Hardware wallets are designed to lock private keys inside a secure chip that never connects to the internet. But among the users who were robbed this time, some had handwritten their recovery phrases on paper and locked them in safes; their private keys had never been digitized. The problem arose much earlier: the devices had already been tampered with before they reached their owners.
The extra chip beneath the screen
On October 8, former Mt. Gox CEO Mark Karpelès had already warned that counterfeit or tampered Ledger devices containing hidden SIM cards were being sold on the market. After the incident broke, he revealed that a Ledger device he had bought in Malaysia had intact outer packaging, but concealed beneath the screen padding was a suspicious module containing a SIM card chip.
SlowMist Chief Information Security Officer 23pds outlined a possible attack path: the recovery phrase is generated inside the secure element and displayed on the screen; a malicious module intercepts the screen data via the SPI bus, then sends the complete 24-word phrase to the attackers over LTE or eSIM.
A secure element can prevent private keys from being read directly, but it cannot necessarily stop surrounding hardware from capturing screen information. The chip wasn’t compromised; the connection between the chip and the screen was.
The ingenuity of this attack is that it doesn’t challenge the hardware wallet’s security architecture; it exploits something outside that architecture. Users see a genuine device, intact packaging, and a normal setup process, but every recovery phrase word displayed on the screen is being recorded in real time.
The distributor’s March change of ownership—and its silence
CryptoBilis’ public profile looks unremarkable. The company, based in Petaling Jaya, Malaysia, is an authorized Ledger distributor in Southeast Asia, serving Indonesia, Malaysia, and the Philippines.
But after the incident came to light, former co-founder Arravind Prabu quickly clarified on X that the company had been acquired back in March this year, and that the former management team had relinquished all operational, managerial, and system access.
Company records show that a person named Jiaming, whose registered address is in Heilongjiang, China, has held 100% of CryptoBilis’ shares since August 3. Yet CryptoBilis’ social media accounts kept posting after the change of ownership, and the latest post even showed off a Lamborghini.
The former team explained that confidentiality clauses in the contract meant the deal could not be publicly announced until October 19. There is currently no conclusive evidence directly linking the change of ownership to the wallet theft. But the overlapping timelines—change of ownership in March, followed by a concentrated wave of thefts from late September to early October—at least raise a question worth pursuing: Which part of the supply chain changed after the new management took over?
$72.9 million remains in the attackers’ addresses
On-chain monitoring by Galaxy’s head of research shows that the Bitcoin losses from this attack currently stand at 213.42 BTC. Of the funds consolidated, 92% had been held in their wallets for less than 90 days. The figure paints a clear picture: most victims were new users who had only recently transferred assets to a new device.
Bitquery’s reconstruction provides a more complete picture: 311 wallets were drained, for a total of around $92.9 million, across five chains—TRON, Bitcoin, Ethereum, BNB Chain, and Polygon. Losses on Ethereum totaled around $42 million, Bitcoin around $17.6 million, and USDT around $16.5 million.
As of now, around $72.9 million remains in addresses controlled by the attackers. Of that, $3.1 million has flowed into Tornado Cash, while the rest is being moved through cross-chain transfers, swaps, and layering. Tether has frozen USDT in some related addresses, but the freeze came after the funds had already been dispersed.
Where are the boundaries of self-custody?
Ledger’s statement was carefully worded: based on the information currently available, the stolen funds were limited to devices sold through CryptoBilis, and there is no indication that Ledger’s security infrastructure, systems, or services were compromised. Technically, this assessment may be accurate. The hardware chip was not broken into, Ledger’s servers were not breached, and Ledger Live was not tampered with.
But this is precisely what makes the incident so concerning. If attackers don’t need to break the chip and only need to tamper with a device at some point between the factory and the user, then the very idea of “cold wallet security” needs to be redefined.
Users can verify whether a device is genuine and whether its firmware has been tampered with, but they cannot verify what happened to the device in transit.
When the security perimeter extends from chips to logistics, from code to distributors, and from technology to contracts and changes in ownership, the last line of defense users can rely on may really come down to one simple judgment: when you get a new device, don’t rush to transfer a large amount of assets to it.
What to watch next
CryptoBilis’ October 19 announcement: Now that the confidentiality clause has expired, will the new management disclose the buyer’s background, changes to supply-chain procedures, and where the device may have been accessed?
Ledger’s final investigation findings: Will it confirm the hardware implant attack path, and will it introduce new requirements for inspecting devices from authorized distributors?
What happens next to the attackers’ addresses: Will the $72.9 million in remaining funds move more quickly into Tornado Cash, and can Tether’s freeze recover more of the funds?
Last time—and this time, too
Ledger has experienced several security incidents: a 2020 customer data breach affecting more than 1 million users; a 2023 Connect Kit supply-chain attack that caused losses of around $480,000 to $600,000; and a counterfeit Ledger Live app in April 2026 that led to around $9.5 million being stolen. Each incident points to the same lesson: the strength of a security chain depends on its weakest link. Last time, it was the software supply chain. This time, it was the hardware supply chain.
#Ledger #SupplyChainAttack #HardwareWallet #CryptoBilis #SelfCustodySecurity