French hardware-wallet manufacturer Ledger is investigating a suspected supply-chain attack involving Southeast Asian reseller CryptoBilis after blockchain researchers traced an estimated $93.2 million in cryptocurrency stolen from 315 wallets across six networks on October 9.
The investigation has uncovered an unauthorized hardware implant inside at least one affected Ledger device, while security researchers have separately reported suspicious modifications in wallets purchased through other retailers. CryptoBilis has suspended hardware-wallet sales in Malaysia, Indonesia, and the Philippines as questions mount over the origin of the compromised devices.
On October 10, Ledger confirmed finding an unauthorized hardware implant in an affected customer’s device. Its October 11 update said the confirmed cases associated with the October 9 draining incident involved purchases through CryptoBilis, and that Ledger’s own systems and direct sales channels remained unaffected.
The investigation has also drawn attention to CryptoBilis’ ownership after its former founders disclosed that they handed over operational control to new management in March 2026, months before the thefts.
How the $93 Million Ledger Wallet Theft Unfolded
The first coordinated wallet-draining transactions began on October 9, with attackers targeting wallets holding Bitcoin, Ethereum, USDT and other cryptocurrencies.
According to Bitquery’s on-chain investigation, the suspected attacker had been preparing the operation since late September. Addresses associated with the theft received initial funding on September 25, followed by 21 small test transactions on TRON and another 20 on Ethereum between September 26 and October 7.
At approximately 04:59 UTC on October 9, the attacker changed the account permissions of 30 TRON wallets, granting a common key control over their funds. Coordinated withdrawals started shortly afterward across Ethereum, BNB Chain, Polygon, Solana, and Bitcoin.
On Bitcoin, approximately 203.8 BTC was transferred from 111 addresses in a single block at around 05:54 UTC, according to the investigation.
Bitquery’s October 11 assessment identified $93.2 million in suspected thefts from 315 wallets across six networks. TRON accounted for approximately $70.5 million, followed by $16.8 million in Bitcoin and $3.7 million in Ethereum. The remaining funds were traced across BNB Chain, Polygon, and Solana.
The estimates have increased as investigators identified additional affected addresses. As The Crypto Times initially reported on October 9, on-chain researcher Specter had estimated losses exceeding $86 million across several networks when Ledger first acknowledged the complaints.
Ledger has not confirmed Bitquery’s latest total or publicly disclosed the final number of affected customers.
Ledger Confirms Hidden Hardware Implant
Ledger acknowledged the incident on October 9 after receiving reports of missing funds from customers who had purchased devices through CryptoBilis. In its initial statement, the company asked the reseller to suspend sales and shipments while its investigation continued.
Customers who had purchased devices from CryptoBilis within the preceding 90 days were advised not to initialize unused products. Those who had already configured their wallets were urged to consider transferring their assets to a new trusted device using a newly generated recovery phrase.
On October 10, Ledger confirmed an unauthorized hardware implant inside one affected device.
The discovery strengthened concerns about physical tampering, which had emerged after former Mt. Gox CEO Mark Karpelès shared details of a suspicious component found in a separate Ledger wallet. The Crypto Times reported Ledger’s confirmation on October 11, noting that the discovery did not establish how every affected wallet had been compromised.
Hardware wallets are designed to isolate private keys from internet-connected devices. During initialization, however, recovery words appear on the device’s screen. Researchers investigating the modified hardware have described implants positioned to intercept the screen’s internal communications.
Such a component could potentially capture a recovery phrase during setup, allowing an attacker to recreate the wallet elsewhere and withdraw its assets without obtaining the original device.
Ledger has not confirmed that every stolen wallet was compromised through this mechanism.
Mark Karpelès and Researchers Report Additional Tampered Wallets
Former Mt. Gox CEO Mark Karpelès reported on October 9 that he had examined a Ledger device shipped from Malaysia with an apparently intact external seal but a concealed component near its display.
Karpelès subsequently shared microscope images and described the suspicious hardware as a miniature spy SIM card. The component was reportedly installed beneath the screen assembly, where it would be difficult for ordinary buyers to detect.
His examination raised concerns that modified hardware could reach customers in packaging that appeared undisturbed.
The Crypto Times covered Karpelès’ discovery and Binance founder Changpeng Zhao’s initial warning on October 10, before Ledger’s subsequent confirmation strengthened evidence of physical tampering in the CryptoBilis investigation.
Separate technical research published by Tibane Labs documented suspicious modifications in Ledger Nano X devices obtained through sellers in Japan, including hardware reportedly shipped from Malaysia.
Security researcher Johannes, posting under @0xJohannes_, reported finding what appeared to be an implant inside a Ledger purchased approximately two weeks earlier from electronics retailer MediaMarkt.
He said the modified device resembled an earlier version of the hardware described in the Southeast Asian reports. However, no funds had been stolen from his wallet.
Ledger has not established that the European device is connected to the October 9 incident. As The Crypto Times reported on October 12, the European findings remain separate from the confirmed CryptoBilis-linked cases. Similar physical modifications alone cannot establish that the devices share an attacker or distribution source.
CryptoBilis Suspends Sales as Former Founders Distance Themselves
Following Ledger’s warning, CryptoBilis suspended Ledger device sales and shipments before extending the halt to its hardware-wallet inventory.
Reports also described temporary closures of retail and online sales channels in Malaysia, Indonesia, and the Philippines while the company reviewed the incident and handled customer complaints.
The suspension followed growing concerns that devices could have been modified before reaching buyers.
Meanwhile, CryptoBilis’ former co-founders, Arravind Prabu and Vimalatheethan, released a statement explaining that they were no longer responsible for the company’s operations. According to their statement, CryptoBilis changed ownership earlier in 2026, with operational and administrative control transferred to new management in March.
The founders said they had not retained access to the company’s backend infrastructure, customer databases, order management systems or administrative accounts since the handover. They acknowledged some limited advisory involvement during industry events after the acquisition but denied having any role in its daily operations. The statement also disclosed that the acquisition agreement included confidentiality provisions delaying a joint public announcement until mid-October 2026.
The former founders identified Nicholas Chang as a contact for inquiries concerning current operations. The Crypto Times has also contacted Cryptobills and is awaiting a response from them.
Separately, reported corporate filings indicate that the reseller’s shares were transferred to new ownership in August 2026. The ownership transfer preceded the October theft, but no publicly verified evidence establishes a criminal connection between the acquisition and the tampered devices.
CZ Questions CryptoBilis Acquisition as Investigation Expands
Binance co-founder Changpeng Zhao, commonly known as CZ, was among the first prominent industry figures to react publicly to the reports. On October 9, he suggested that the early evidence pointed toward a supply-chain attack involving a particular vendor rather than a compromise across Ledger’s broader hardware-wallet ecosystem. He also encouraged efforts to trace and recover the stolen funds.
Zhao later made a stronger allegation after details of the CryptoBilis ownership transfer emerged.
In an October 12 post on X, CZ claimed that the hackers had apparently purchased the reseller and required a non-disclosure agreement.
The accusation linked two developments that had already attracted scrutiny: the reseller’s acquisition earlier in 2026 and the thefts in October.
However, while former management has acknowledged the ownership transfer and confidentiality agreement, no publicly disclosed evidence establishes that the buyer was associated with the attackers or that the acquisition was intended to facilitate the theft.
Ledger has not publicly attributed responsibility for the hardware modifications to CryptoBilis’ current owners or former management.
Investigators Trace Stolen Funds Through Tornado Cash and Zcash
Blockchain investigators have also followed the movement of stolen assets as the attackers transferred funds through exchanges, cross-chain services and privacy-related protocols.
Bitquery reported that Tether froze approximately $10 million in USDT associated with addresses linked to the incident, preventing further transfers of those tokens while investigations continued.
Other stolen assets were converted into Ethereum and routed through Tornado Cash. Researchers also identified transactions involving Zcash, another cryptocurrency offering privacy-related transaction features.
According to Bitquery’s October 11 findings, approximately 2,990 ETH had been sent through Tornado Cash over two days. Investigators subsequently identified wallets holding approximately $5.35 million in USDC that they associated with the transaction trails.
Those assets could represent another potential recovery opportunity, although the researchers’ findings did not establish that Circle had frozen the associated USDC. Bitquery estimated that approximately $81 million in suspected stolen funds remained traceable on-chain at the time of its assessment.
That amount should not be confused with assets already recovered, and tracing funds through intermediate wallets does not necessarily establish the ultimate recipient or identify the attacker.
Ledger Maintains Confirmed Cases Are Limited to CryptoBilis
In its October 11 update, Ledger said the volume of affected devices appeared limited and maintained that the confirmed cases connected to the October 9 draining incident involved products purchased through CryptoBilis.
The company reiterated that its internal systems and direct sales channels remained unaffected. Ledger also urged authorized resellers to obtain hardware through approved distribution networks and avoid restocking devices returned by customers.
The company said it was cooperating with relevant authorities and acknowledged assistance from security-response organization SEAL 911.
The investigation now involves several unresolved questions, including when the affected hardware was modified, whether the independently reported implants share a common source, and whether the reseller’s ownership change has any connection to the theft.
There has been no publicly verified identification of those responsible for installing the implants or carrying out the coordinated withdrawals.
Customers who purchased Ledger devices from CryptoBilis during the period identified by the company have been advised not to initialize unused products and to consider moving their assets to a trusted signer with a newly generated recovery phrase if they have already set up a potentially affected wallet.
As of October 12, the full number of affected physical devices, the confirmed loss total and the identities of those responsible remain under investigation.
