A hardware wallet is the product people buy because they do not trust anyone else to hold their bitcoin. On Saturday 10 October 2026, Ledger, the Paris-based maker of one of the best-known devices, confirmed that one affected customer’s wallet contained an “unauthorized hardware implant”, according to Bitcoin.com News, which reports it as the company’s first confirmation of physical tampering in the case (Bitcoin.com News, 10 October 2026). The confirmation came a day after on-chain investigators first put losses above $86 million across hundreds of wallets. Bitcoin itself barely noticed: it traded at $82,958 on Coinbase at about 06:15 UTC on Sunday 11 October, up 0.5% from Friday’s close of $82,545.
What Ledger has said, and what it has not
Ledger’s first statement, posted on X on Friday 9 October, said it was investigating “reports of loss of funds” from users who bought devices from a Southeast Asian reseller, CryptoBilis. It asked the reseller to pause sales and shipments, told anyone who bought from CryptoBilis in the past 90 days not to set up their device, and advised those who already had to consider moving their assets to a new Ledger signer with a new seed phrase (Decrypt, 9 October 2026; CoinDesk, 9 October 2026). It did not confirm a loss figure or a cause.
On Saturday it went further. According to Bitcoin.com News, Ledger said “one of the impacted users’ devices contained an unauthorized hardware implant”; that it has “no indication that Ledger’s security infrastructure, systems or services have been compromised”; that it is contacting impacted users, cooperating with authorities and working on “further, enhanced anti-tampering solutions”; and that it thanked the SEAL 911 security group for assisting investigators. TokenPost, publishing the same evening, reports the same confirmation and says CryptoBilis has suspended hardware-wallet sales until the investigation ends (TokenPost, 10 October 2026).
The video above, from the channel Digital Asset News and uploaded on 9 October 2026, was made before Ledger’s Saturday confirmation. Its title takes a position on the “not your keys, not your coins” debate that this article does not endorse; it is included for the timeline of the first day’s reaction.
How large is the loss? Four different numbers
There is no official figure. The estimates below come from on-chain analysts counting addresses they believe are connected to the thefts, and none has been verified by Ledger. They differ because analysts include different addresses, price tokens at different times and cannot yet tell whether every drained wallet came from the same batch of devices.
| Source | Estimate | Detail | Date |
|---|---|---|---|
| Specter (pseudonymous on-chain investigator), via Decrypt and CoinDesk | “$86M+” | Hundreds of victim wallets across Ethereum, Tron and Bitcoin | 9 Oct |
| Arkham data cited by Specter, via Decrypt | ~$87M | About $42M in ETH, $17.6M in BTC and $16.5M in USDT | 9 Oct |
| Yfarmx, via Bitcoin.com News | ~$93.4M | 471 addresses | 10 Oct |
| Bitquery, via Bitcoin.com News | ~$92.9M | 311 unique addresses | 10 Oct |
The honest summary is a range of roughly $86 million to $93 million, spread across bitcoin, ether and the Tron stablecoin USDT. Of the $87 million Arkham-based breakdown, only about $17.6 million was in bitcoin; most of the value was in ether and dollar stablecoins, which is one reason the bitcoin price did not react.
What is still unknown
- How many devices were modified. Bitcoin.com News reports that Mark Karpelès, the former Mt. Gox chief executive, documented a modified Ledger Nano X containing a concealed circuit board and cellular communications hardware that could intercept a recovery phrase by watching data sent to the display during setup. This comes from one outlet, and the same report says investigators have not established that every affected wallet contained similar equipment.
- Whether the reseller was authorized. The coverage reviewed calls CryptoBilis a reseller or distributor but does not say whether Ledger lists it as an authorized seller.
- Whether every theft is linked. Decrypt notes it is unclear whether every theft is tied to the reseller; CoinDesk says it is unclear what caused the losses.
- Refunds and responsibility. Bitcoin.com News says users asked whether victims will be compensated and that Ledger’s handling drew criticism; no compensation has been announced in the sources reviewed.
Why this is a different kind of risk
Most headline crypto thefts exploit software: a protocol bug, a stolen server key, a phishing link. This case, if the implant account holds, attacks something earlier. The device is compromised before the owner ever turns it on, so every good habit the owner follows afterwards (a strong PIN, an offline seed backup, never typing the phrase into a computer) protects nothing, because the secret was exposed at the moment it was created. That is why Ledger’s own buying guidance puts the purchase channel first: buy from Ledger.com or an authorized reseller, inspect the packaging, and treat any device that arrives with a pre-set recovery phrase or PIN as unusable (Ledger Academy, best practices to securely buy a Ledger signer).
The same guidance contains a limitation worth knowing. Ledger states that its Genuine Check, the signature test run during setup, cannot detect unauthorized physical modifications if the original secure element is intact, and cannot verify a device’s supply-chain history. In other words, a clean check is necessary but not sufficient, and provenance matters more than any test a buyer can run at home. This desk’s step-by-step version of those checks is today’s field guide: How to Check a Hardware Wallet Was Not Tampered With (Field Guide #55).
What the bitcoin market did
Almost nothing. Coinbase Exchange daily candles show bitcoin opening Saturday 10 October at $82,545 and closing at $82,911, a range of $82,458 to $83,093, or 0.77% for the day; Sunday’s candle, still open at 06:15 UTC, showed $82,714 to $83,071. Ether, the largest single component of the reported theft, closed Saturday at $2,504 after $2,485 on Friday. Nothing in the price data links the move to the story, and no causal claim is made here: this was a quiet weekend, as the companion CPI analysis notes, ahead of Wednesday’s inflation report.
What readers who own a hardware wallet should do now
- If you bought a Ledger from CryptoBilis in the last 90 days: follow Ledger’s instruction — do not set the device up if you have not already; if you have, consider moving funds to a new signer, bought from Ledger.com or a listed authorized reseller, with a newly generated seed.
- If you bought elsewhere: there is no evidence in the sources reviewed that devices from other channels are affected. Re-check where yours came from and how the box looked when it arrived.
- Never act on an unsolicited message. Ledger reminds customers it will never ask for a 24-word recovery phrase; fake “security update” emails typically follow stories like this.
- Do the migration carefully. The desk’s guide to moving all your bitcoin to a new wallet covers the order of operations.
For readers weighing the broader trade-off between holding bitcoin through a regulated fund and holding it yourself, the desk’s ETF versus self-custody decision framework sets out the risks on both sides, including the one this story illustrates: self-custody moves the failure points from a company to your purchase and setup process.
Sources: Decrypt (9 October 2026); CoinDesk (9 October 2026, updated); Bitcoin.com News (10 October 2026); TokenPost (10 October 2026); Blockonomi (9 October 2026); Ledger Academy; Coinbase Exchange candles. Loss figures are third-party estimates, not Ledger’s. The implant details attributed to Mark Karpelès are reported by a single outlet and have not been independently confirmed by this desk.
Method: bitcoin and ether prices, highs, lows and closes are Coinbase Exchange candles (UTC day or UTC hour) pulled by Bitcoin Mastery at about 06:15 UTC on Sunday 11 October 2026; the 11 October candle is still open at that time, so any closing figure quoted is the 10 October close unless stated. Third-party figures are attributed to their source and date. Facts about the Ledger case are as reported by the outlets named; this desk has no independent confirmation of the theft totals.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.