Ledger has now said how the tampered hardware wallets stole money. In an investigation update posted on X on Tuesday 13 October 2026, the company said an unauthorised implant inside some devices sold by the reseller CryptoBilis read the 24-word recovery phrase when the signer displayed it during setup and sent it over a mobile network, according to CoinDesk (CoinDesk, 13 October 2026). Anyone holding the phrase could restore the wallet elsewhere and move the funds without the physical device. Onchain researchers estimate losses of up to $93.2 million across more than 300 wallets; Ledger itself has not confirmed the number of victims or the amount stolen.
What Ledger said, and what it did not
Ledger described the thefts as a physical attack on its supply chain and not a breach of its software or internal systems. The implant sat inside the device enclosure. When the signer showed a recovery phrase during setup, the implant’s microcontroller read and decoded the words and transmitted them over LTE using an eSIM. Ledger said it did not modify the secure element or the operating system, and that the implant did not alter transactions or signatures. The company is still investigating who tampered with the devices and at what point in the distribution chain.
Chief technology officer Charles Guillemet said on X that Ledger “is reviewing its reseller controls and anti-tamper protections,” and added: “We invite researchers and other vendors to work with us on tamper-detection and chain-of-custody practices.” Chief executive Pascal Gauthier said the company is reviewing controls for both direct sales and resellers and that “we will share what we can.” Both statements are quoted from CoinDesk’s report of the update; we have not seen the underlying posts.
This is new information compared with our 11 October report, when Ledger had confirmed an unauthorised implant in one customer’s device but had not described its mechanism. The mechanism matters: it means the compromise was of the recovery phrase, not of the device’s ability to sign, so replacing the hardware alone does not make a stolen wallet safe again.
The numbers so far
Every confirmed loss in the 9 October incident involved a device sold by CryptoBilis, according to Ledger. The company had not verified a theft involving a signer bought elsewhere, but said it is examining reports of implants in other devices and locations. Onchain estimates of the total have ranged: our earlier reports collected figures from roughly $86 million to $93 million depending on the analytics firm and the number of addresses counted, and the new $93.2 million estimate covers more than 300 wallets. These are researcher estimates and not Ledger figures. Tether froze $10 million of USDT tied to the theft, per CoinDesk.
Two further reports remain unverified. Mark Karpelès, the former Mt. Gox chief executive, claimed he found an implant in a Ledger Flex bought at Singapore’s airport, and Ledger said the retailer MediaMarkt Saturn stopped selling its devices after a customer in Germany reported a “spy” implant. CoinDesk presents both as claims; neither has been confirmed by Ledger as a separate case. CryptoBilis has stopped selling Ledger signers, according to Ledger and Gauthier.
What Ledger tells users to do
Ledger’s advice, as reported: do not initialise any unused device bought from CryptoBilis, and if you have already used one, move your assets to a new device with a newly generated recovery phrase. The second step matters because the phrase on the old wallet may have been copied. Do the move with a device from a source you trust, generate the new phrase on the new device, and send a small test transaction first. The old phrase should be treated as compromised permanently, even if the wallet has not yet been emptied, because a thief can wait.
For readers who bought from someone else, our Field Guide #55 lists eight checks, including how to confirm a device’s origin and how to inspect it. None of those checks is perfect: Ledger has itself said that its own authenticity check cannot detect a physical modification if the original secure element is intact, and in this attack the secure element was not touched. Buying directly from the manufacturer reduces, but as this case shows may not eliminate, the exposure to reseller-level tampering, and Ledger says it is reviewing its direct-sales controls as well.
Why it matters for the market
Bitcoin barely reacted when the story broke: Coinbase candles show it closing at $83,101.99 on Tuesday, up 1.66%, and trading at about $83,500 in the first hours of Wednesday. A $93 million theft is small next to bitcoin’s daily volume. The significance is for self-custody. Hardware wallets are the standard answer to exchange risk, as the news from South Korea this week shows with 27 unregistered exchanges blocked (see our new Field Guide #58). The Ledger case shows that the risk moves from the exchange to the supply chain; the tamper-detection and chain-of-custody work that Guillemet invited other vendors to join is where the industry response will be judged.
What to watch
Four things will tell us how large the incident becomes: whether Ledger confirms a victim count and a loss figure; whether it identifies where in the distribution chain the devices were modified; whether any case emerges involving a device bought outside CryptoBilis; and what new anti-tamper or reseller rules Ledger announces. We will update this article when any of those are reported. None of this is a reason to panic about hardware wallets in general, and none of it is investment advice.
Method: bitcoin and ether prices, highs, lows and closes are Coinbase Exchange candles (UTC day or UTC hour) pulled by Bitcoin Mastery at about 06:15 UTC on Wednesday 14 October 2026; the 14 October candle is still open at that time, so any closing figure quoted is the 13 October close unless stated. Semiconductor-ETF (SOXX) and Kospi figures are Yahoo Finance daily closes; other third-party figures are attributed to their source and date. All Ledger statements are as reported by CoinDesk on 13 October 2026; Bitcoin Mastery has not independently verified the technical description or the loss estimates. The bitcoin close is the Coinbase UTC daily candle.
Disclaimer: This article is for informational purposes only and does not constitute investment advice. Bitcoin and other cryptocurrencies are volatile and you can lose some or all of the money you put in. Nothing here is a recommendation to buy, sell or hold bitcoin, any exchange-traded fund, any listed security or any other asset, and the technical levels, probabilities and scenarios discussed are descriptions of published data, not forecasts. Do your own research and consult a licensed financial advisor before making investment decisions.