Ledger Hardware Implant Attack: $100M-Plus Loss Estimates and Where the Devices Were Sold

Updated October 14, 2026, 12:00 HKT. The latest official notice reviewed was published October 13 at 22:03 UTC, or October 14 at 06:03 HKT. Dollar amounts are US dollars. The photographs below show credited research specimens and buyer reports; captions identify the evidence behind each image.

Ledger’s hardware-wallet crisis has moved beyond the original warning about one Southeast Asian reseller. The company has confirmed an unauthorized hardware implant in an affected customer’s device and explained how the attack steals recovery phrases. It has also asked resellers and distributors across Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove devices from shelves. Ledger’s regional sales-halt notice.

Researchers now estimate the suspected thefts at $102 million to $103.4 million. Those are competing estimates, not amounts to add together, and Ledger has not verified a final total. Bitquery investigation, YFarmX incident record.

The central distinction is between confirmed loss cases and the wider circulation of reportedly tampered devices. Ledger’s October 13 technical update ties every verified loss in this incident to CryptoBilis. Separately, researchers and buyers have reported implants in devices obtained through other channels, including German retail stores and Singapore. Those reports expand the supply-chain questions; they do not establish that every retailer or every Ledger is compromised. Ledger’s technical update.

What is the Ledger hack?

This is a physical attack on the device before it reaches its owner. According to Ledger’s Donjon security team, an added component inside the enclosure reads the screen data during setup, decodes the 24 recovery words, and sends them over LTE using a provisioned eSIM. Ledger says the implant leaves the Secure Element and operating system unchanged and does not alter transactions or signatures. Donjon findings published by Ledger.

That explains the otherwise confusing combination: an authentic device, apparently normal operation, and funds that can later disappear without another button press. Once an attacker has the recovery phrase, the attacker can recreate the wallet elsewhere. Removing the implant afterward cannot revoke a copy of the secret already stolen. Mark Karpelès made that point explicitly: a phrase generated or imported on an implanted device must be treated as compromised, even if the attacker waits before spending. Karpelès’s warning.

Calling these devices simply “fake Ledgers” can obscure the mechanism. The dangerous combination is genuine Ledger hardware plus an unauthorized addition. A software check that recognizes the authentic security chip does not necessarily prove that nobody attached another circuit around it. Ledger’s own hardware-integrity guidance addresses this limitation. Ledger hardware-integrity guide.

Why intact packaging and a normal battery are insufficient

Karpelès said his implanted device arrived from Malaysia with flawless shrink-wrap; the extra board was concealed where the screen padding should have been. He had already posted a comparison of older and newer implants on September 16, weeks before the October 9 draining reports. Packaging report, September comparison photographs.

Tibane Labs’ physical examinations show evolving designs. One specimen used a smaller battery and an added flexible circuit. Another retained the original battery and concealed a black-coated board behind the display, with a cellular module, eSIM and antenna. A check based only on battery size could therefore miss a newer variant. BleepingComputer’s account of the examinations.

These findings explain why an owner could follow the usual setup process and still be exposed. They do not show that every loss identified on-chain came from an implant: that requires examining the devices and establishing each buyer’s purchase history.

Where were the compromised Ledgers sold?

The evidence has several different levels of certainty. A retailer named in a buyer’s report is not automatically the place where tampering occurred.

Sales channel or location	What the sources establish	Loss status and limitation
CryptoBilis: Malaysia, Indonesia and the Philippines	Ledger links its confirmed loss cases to this reseller. CryptoBilis’s own notice covers its stores and online channels in these three countries.	Confirmed incident channel according to Ledger; no official victim count or loss total. Ledger, CryptoBilis.
MediaMarkt stores in Germany	Buyer Johannes reported two modified devices bought from different branches, publishing photographs and an unboxing video. Ledger subsequently acknowledged a German customer’s implant report and announced a MediaMarkt Saturn sales pause.	Ledger said no loss was reported in that case. It did not confirm that inventory across Europe was infected. Buyer’s report, Ledger’s response.
Metapod at Singapore airport	Ben Yorke said he bought an unused Flex there during the summer. Karpelès later reported finding an implant after receiving it.	A buyer account followed by a researcher’s examination; no quantified theft disclosed in these posts. Purchase account, examination report.
Challenger, VivoCity, Singapore	X user @effdog_ posted a photograph and said the device had been purchased at that outlet the previous week.	An allegation requesting verification, not an independently established loss case. Original buyer post.
Amazon Japan third-party marketplace seller	Tibane Labs says it obtained an implanted Nano X from a China-based seller, shipped from Malaysia.	Research specimen; this does not implicate all Amazon stock or establish a CryptoBilis connection. Primary examination.
Yahoo! Auctions, Japan	Tibane Labs obtained another implanted Nano X through this channel.	Research specimen; its earlier distribution history remains unresolved. Primary examination.

CryptoBilis’s authorized status matters. Buyers were not simply ignoring advice to use approved sellers. Its official X profile described it as an authorized reseller, and contemporary reporting documented its presence on Ledger’s reseller list. The question is what oversight, sourcing controls and inspection accompanied that authorization. CryptoBilis profile and notice, CoinDesk’s reporting on authorization.

Johannes also said store records identified Aqipa GmbH as the distributor and that an employee told him the device was not a customer return. These are investigative leads reported by the buyer. They do not establish that Aqipa, MediaMarkt employees or any named company installed the implants. His claim that the problem could span more than 1,000 stores is a warning about potential exposure, not a count of affected stores. Original October 12 post.

For Hong Kong readers, the latest notice means Ledger requested a precautionary stop to reseller and distributor sales in Hong Kong. It does not announce a verified Hong Kong theft or prove that every shop complied immediately. Regional notice.

More photographs from Singapore and the Stax reports

The following posts widen the picture of what buyers and researchers are examining. Neither establishes an additional dollar loss for the tables below.

How much has been lost so far?

There is no Ledger-certified loss total. The best-supported presentation is to show each estimate with its date and scope, rather than manufacture a single definitive figure.

Source and snapshot	Reported suspected loss	Coverage	How to interpret it
Specter, October 9	More than $86 million	Hundreds of wallets; published ten collection addresses across major chains	Early on-chain estimate.
Bitquery’s October 9 X post	$92.9 million	311 wallets across five chains	Historical snapshot, since revised.
Bitquery, updated October 13	$102.0 million	324 wallets across six chains	Counts victim outflows; excludes transfers among attacker wallets.
YFarmX, revised October 12; tracker updated October 13	$103.4 million	530 sending addresses	Broader address set; uses October 9 valuation. Addresses are not individual people.
Ledger, October 13	Not confirmed	Confirmed loss cases tied to CryptoBilis	Company has not verified the aggregate figures or total affected-user count.

The $102 million and $103.4 million figures overlap. They are neither separate hacks nor a statistical confidence interval. Different address inclusion rules can produce different totals and radically different wallet counts. Nine additional TRON addresses in YFarmX’s revision account for roughly $8.81 million sent on October 9; finding those transfers later does not make them new October 12 thefts. YFarmX’s revision methodology.

Losses by blockchain

This table uses one consistent dataset: Bitquery’s October 13 revision, valued at October 9 prices. It is an analyst estimate, not our independent reconstruction.

Blockchain	Wallets counted on that chain	Estimated loss
TRON	140	$79.3 million
Bitcoin	122	$16.8 million
Ethereum	33	$3.7 million
BNB Chain	27	$1.45 million
Polygon	13	$0.58 million
Solana	4	$0.25 million
Total after wallet deduplication	324	$102.0 million

Chain rows sum to 339 because some EVM wallets appear on multiple chains. Dollar rows sum to $102.08 million because of rounding. Bitquery’s chain breakdown.

Individual losses reported on X

These illustrate the damage. They must not be added to the aggregate estimates, which may already include them.

Report	Amount	What is actually supported
Lookonchain, October 9: TRON wallet abbreviated TY24Ya	About 7 million USDT	Lookonchain attributes the loss to a buyer who obtained a device from CryptoBilis three weeks earlier. The purchase history is the analyst’s report.
Lookonchain, October 9: Bitcoin holder	80 BTC	The post describes $5.2 million acquisition cost and $1.38 million unrealized profit, implying roughly $6.58 million at its quoted valuation. The loss quantity is 80 BTC; $5.2 million was not the theft-date valuation.
Lookonchain, October 10: Ethereum holder	59 ETH, quoted at $146,800	Analyst-reported loss after a move to a newer wallet.
@EdwardTWinz, October 9	Claimed $1 million	The author explicitly says he does not know whether his loss is connected. Excluded from our incident accounting.

An on-chain transfer can demonstrate money moved. It cannot, by itself, prove which shop sold the signer, when it was bought or which physical component leaked the key. Those claims need invoices, devices and corroborating investigation.

Frozen funds are not returned funds

Bitquery’s original X report said Tether froze approximately $10 million. YFarmX’s later tracing also records roughly that amount. A freeze may prevent further movement, but it is not evidence that victims have been repaid. Bitquery’s post, YFarmX’s tracing update.

Investigators have continued following the proceeds. MistTrack reported approximately 463 ETH entering Tornado Cash on October 10. YFarmX’s October 13 update describes a further 500 ETH deposited that day and links subsequent movements to privately deployed copies of Railgun contracts. Those are tracing findings with attribution limits, and movements of already stolen money must not be counted as additional thefts. The private deployments are distinct from Railgun’s public deployment. MistTrack’s original post, YFarmX investigation.

There is also a practical ongoing risk: sending money to an already compromised address. Bitquery reported that a further 70,000 USDT arrived in a drained TRON wallet on October 10 and was taken within ten minutes. Its updated $102 million headline explicitly excludes this later payment. Original warning, accounting note.

None of the official Ledger statements reviewed announces a blanket reimbursement commitment. A final net-loss number would require confirmed recoveries and returns, not simply subtracting frozen tokens from an estimate.

Ledger’s official response: how it developed

Times below are UTC; add eight hours for Hong Kong and Singapore.

Date and time	Official action or statement
October 9, 13:32	Ledger Support announced its investigation, asked CryptoBilis to pause sales and shipments, and initially addressed buyers from the previous 90 days. Unused devices should not be initialized; existing users were advised to consider a new signer and seed. Initial notice.
October 10, 17:09	Ledger confirmed an implant in one affected user’s device, said CryptoBilis had ceased all hardware-wallet sales, and acknowledged cooperation with authorities and SEAL 911. Confirmation.
October 11, 17:13	Ledger described the affected volume as limited, tied confirmed cases to CryptoBilis, and told authorized resellers to source through authorized channels and never restock returns. It announced reviews of reseller controls and further hardware protections. Company update.
October 13, 06:39–06:46	Ledger published the Donjon mechanism. CEO Pascal Gauthier said he and the executive team were leading the investigation, including the unresolved point of tampering in distribution. Technical update, CEO statement.
October 13, 12:29	Ledger announced a MediaMarkt Saturn pause in stores and online after a German implant report, with no reported loss in that case. European retail notice.
October 13, 22:03	Ledger asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales, including removing products from shelves. It reiterated that it had not verified a drain linked to a device bought elsewhere and had no indication of compromised infrastructure, systems, services or direct sales. Latest regional notice.

There is an important implementation dispute. At 15:25 UTC on October 13, Johannes said he had visited another MediaMarkt branch at approximately 15:00 UTC and still found Ledger devices on sale. He said staff removed them after he raised the issue, while acknowledging the online listings had already disappeared. This challenges the speed of the retail stop reaching individual stores; it is not independent proof of chain-wide noncompliance. His follow-up report.

Ledger’s response has become more specific and broader geographically. Its assurance about its own systems answers one question, but does not settle the safety of every physical unit already distributed. Buyers need affected batches, dates, routes and a clear remedy. The statements reviewed do not provide a complete serial-number list or a numerical ceiling on compromised devices.

What CryptoBilis has said—and what remains unproven

CryptoBilis published two image notices dated October 10. The first said Ledger sales and shipments were paused, instructed customers to follow Ledger’s guidance, and asked affected buyers to retain devices, packaging and purchase information. The second expanded the pause to all hardware-wallet brands across its Malaysian, Philippine and Indonesian stores and online channels, and said physical stores were temporarily closed. That precaution is not proof that other brands were tampered with. Original notice, expanded sales pause.

Ownership changes have become a major topic on X. Former co-founders Arravind Prabu and Vimalatheethan say they handed over operations in March 2026 and lost system access. That is their account, not an independently audited history. An acquisition, or a shareholder’s nationality, does not establish responsibility for the attack. Their statement, reproduced by Tibane Labs.

Gauthier’s own statement leaves the key attribution questions open: who installed the implants, and where in the distribution chain did it happen? It says Ledger is examining devices, contacting affected users and working with law enforcement. CEO’s statement.

What affected owners should do

For CryptoBilis buyers, Ledger’s current instructions are clear: do not initialize an unused device; if it has already been used, transfer assets promptly to a new signer with a new recovery phrase. Do not restore any recovery phrase on a CryptoBilis device. Simply importing the old words into new hardware would leave the same secret controlling the funds. Ledger’s instructions.

Preserve purchase records, packaging, transaction IDs and the device. If funds were lost, coordinate with Ledger Support and law enforcement before opening or sending away the signer. Ledger says it will never call, privately message or request the 24 words. Use the official support site directly. Ledger’s evidence-preservation guidance, Ledger Support.

For other channels, distinguish a sales pause from an individualized diagnosis. Contact official support about the particular device and purchase route. Physical-inspection videos can explain the research, but a clean-looking case is not a certificate of safety, and opening a device can damage it. Follow the manufacturer’s guidance and preserve evidence in loss cases. Ledger’s inspection guidance.

The failure exposed here is serious: a trusted purchase route and a genuine security chip did not, in the confirmed case, keep a recovery phrase secret. Resolving that requires more than telling customers to avoid suspicious sellers. It requires determining how altered stock reached an authorized channel, removing affected inventory, and explaining what happens to the people whose assets were stolen.

Original videos, photographs and statements

These links distinguish research specimens, buyer reports and official notices. Photographs can show unusual components; they cannot independently authenticate a receipt or identify the perpetrator. The videos are linked as source material, not a recommendation to dismantle a wallet holding funds.

Source	Media	What it documents
Johannes, October 12	Original unboxing video on X · purchase report and photographs	The buyer’s second reported MediaMarkt device.
Mark Karpelès, October 13	Singapore Flex examination video · original X report	The device Ben Yorke said he bought at Singapore airport.
Mark Karpelès, October 11	Nano X implant-identification video · source post	Known implant appearances and display connections.
Dave Jones / EEVblog, October 13	EEVblog 1780 video links and outline	An engineering discussion of the hardware attack and possible mitigations.
Tibane Labs	Photograph: concealed board under the screen · photograph: removed flexible implant · full examination	Research specimens and component placement. Credit: Tibane Labs.
CryptoBilis, October 10	Initial statement image · sales-pause image	The reseller’s own notices. Credit: CryptoBilis; original post.
@wentrre and SlowMist’s founder	Stax owner’s photographs · @evilcos comparison	A separate Stax report. Not a quantified loss case or proof that all Stax devices are affected.

Research note: Original X posts were retrieved through the twitterapi.io MCP using keyword searches and direct post-ID lookups. Statement images and research-page media were also inspected in the browser. Loss figures are attributed to their originating researchers; we have not independently rebuilt the complete blockchain dataset, examined the devices, authenticated purchase receipts or established the attackers’ identity. The article separates those limits from Ledger’s confirmed findings and preserves historical estimates as dated snapshots.