Ledger implant hack explained: how up to $102M was stolen

Attackers stole up to $102 million from 324 wallets across six blockchains, according to Bitquery, using Ledger devices sold by Southeast Asian reseller CryptoBilis. Inside the devices sat a foreign module with its own eSIM: during setup it read the 24-word recovery phrase off the screen and sent it out over a cellular network. Ledger has confirmed the implant but has not given a total loss or victim count, and on Oct. 13 it asked sellers in seven Asian markets to pull its devices from shelves.

What we know now

• Loss estimates range from $86 million (Specter) to $102 million (Bitquery); these are onchain tallies that Ledger has not verified.
• Every confirmed theft involves a device sold by CryptoBilis; Ledger has not verified a drain tied to a device bought elsewhere.
• Ledger asked resellers in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and take devices off the shelves.
• Tether froze $10 million of USDT; Bitquery counted about $84 million still on the attacker's addresses as of Oct. 13, with funds steadily laundered through swap services and Tornado Cash.
• Who tampered with the devices, and where in the supply chain, is still unknown; Ledger's Donjon security team is analyzing recovered units, and the company says it is working with law enforcement.

How it happened

This is a physical supply-chain attack, not a breach of Ledger's firmware. Per Ledger Donjon, the implant sits inside the enclosure and reads what is shown on the screen. During first setup the device displays the 24-word recovery phrase; the implant's microcontroller recognizes those screens, decodes the words and transmits them over LTE using a provisioned eSIM. It does not touch the Secure Element chip, the operating system, transactions or signatures.

The recovery phrase is the master key: with it an attacker can rebuild the wallet on any device and no longer needs the victim's hardware. That is why the attack targets setup rather than signing. Onchain data suggests the phrases were collected for weeks: Bitquery found that the attacker's Tron and Ethereum control addresses were first funded on Sept. 25, followed by dozens of small test transfers through Oct. 7. The wallets were then drained almost simultaneously on Oct. 9.

The Block reports that former Mt. Gox CEO Mark Karpelès said he found a spy implant in a Ledger Flex bought at Singapore's airport; Ledger has not confirmed a link to the CryptoBilis case.

Timeline

Sept. 25. The attacker's Tron and Ethereum control addresses receive their first funds, three minutes apart (Bitquery).

Oct. 9, 12:59 AM ET. The attacker's key is added to the permissions of 30 Tron wallets; USDT pulls begin eight minutes later.

Oct. 9, 1:54 AM ET. 111 bitcoin wallets are emptied in a single block.

Oct. 9, around 8:00 AM ET. Onchain analysts tanuki42 and Specter publish the collection addresses, estimating more than $72 million and more than $86 million across Bitcoin, Ethereum and Tron (The Block).

Oct. 9, 8:09⁠–⁠10:10 AM ET. Tether blacklists 37 addresses, 20 of them holding $10 million of USDT.

Oct. 9, 9:32 AM ET. Ledger announces an investigation, asks CryptoBilis to halt sales and shipments, and tells anyone who bought from the reseller in the past 90 days not to set up their device.

Oct. 9, 11:17 AM ET. The first batch of ether goes into Tornado Cash.

Oct. 10, 1:09 PM ET. Ledger confirms an unauthorized implant in one victim's device.

Oct. 11, 1:13 PM ET. In a 72-hour update, Ledger says it is working with authorities, that the number of affected devices is "limited," and that CryptoBilis has stopped selling all hardware wallets. The same day PeckShield traces about 3.69 million USDT and 615,000 TRX to Binance deposit addresses (Crypto Briefing).

Oct. 12. CoinDesk, citing Bitquery, reports $93 million traced and $10 million frozen (CoinDesk).

Oct. 13, 2:39 AM ET. Ledger Donjon explains the mechanism: the implant reads the recovery phrase off the screen and sends it over LTE via an eSIM. Bitquery raises its estimate to $102 million from 324 wallets.

Oct. 13, daytime. MediaMarktSaturn pulls all Ledger products from its stores and websites after a complaint from a customer in Germany; Ledger says no funds were lost in that case. Trezor and OneKey drop CryptoBilis as a reseller, and OneKey offers free replacements (The Block).

Oct. 13, 6:03 PM ET. Ledger asks resellers and distributors in seven Asian markets to suspend sales and take devices off the shelves. More in our news story.

Where the money went

Per Bitquery's count (USD at Oct. 9 prices):

Some wallets were hit on more than one chain, so the rows add up to more than 324.

The bulk of the haul, USDT on Tron, was rushed out of Tether's reach. About $23.7 million was swapped into USDD, a stablecoin Tether cannot freeze, and then into ether via THORChain; in total 26.9 million USDT passed through THORChain, coming out as 10,636 ETH. Another 20 million USDT crossed to Ethereum over the USDT0 bridge and became 7,994 ETH. Other services were used too: Relay.link (about $9.4 million), Chainflip (about $4.6 million) and NEAR Intents.

From Oct. 9 to 13 about 6,840 ETH went into Tornado Cash; most of it, Bitquery says, then moved through Zcash and NEAR Intents into USDC and ETH (the analysts rate those links as likely, not proven). Two probable attacker addresses hold 2.38 million USDC that Circle could still freeze. Funds on tracked addresses fell from $97 million on the morning of Oct. 10 to $84 million on the morning of Oct. 13.

What the company and exchanges did

• Ledger halted sales through CryptoBilis, then at all resellers in seven Asian markets, is working with law enforcement and thanked the SEAL 911 emergency-response group for its help. CryptoBilis buyers are told not to set up unopened devices and to move funds from any device already in use to a new one with a new recovery phrase; victims are told to contact police before opening the device.
• CryptoBilis stopped selling all hardware-wallet brands; the reseller has not publicly explained how the modules got into the devices.
• Tether froze $10 million of USDT across 20 addresses.
• MediaMarktSaturn pulled Ledger products in Europe; Trezor and OneKey cut ties with CryptoBilis, and Trezor is also trimming its reseller network.
• Binance has not commented publicly on the deposits flagged by PeckShield.

What it means for holders

Ledger has no token, so there is no market reaction in the usual sense. The lesson is about where a device comes from: a secure chip does not help if the unit was opened before it reached the buyer, and this implant captures the screen, not the key. That is why wallet makers insist on buying directly from them or from authorized sellers.

For Tether holders the case shows both sides of a centralized stablecoin: $10 million was frozen within hours, but the attacker quickly moved into USDD and ether, where no such switch exists. For live market data see the daily summary.

This is not investment advice.

This story is developing. We are tracking events and adding new information as it is confirmed. Last updated Oct. 13, 2026, 10:30 PM ET.