Booby-trapped Ledgers: the CryptoBilis case and how to stay safe

On 9 October 2026, Ledger buyers watched their crypto disappear. According to Bitquery’s investigation, the funds that left the victims’ wallets add up to about $102 million, across 335 wallets (324 before the 16 October update, which added eleven TRON wallets without changing the total).

• It is an estimate, worked out from public blockchain data, not a figure validated by Ledger. Ledger has given neither a total amount nor a number of affected devices.
• It is not “every Ledger”: according to Ledger, all confirmed cases involve devices sold by a single reseller, and its own sales channels are unaffected.
• It is not about one brand: other makers, such as Trezor, have had incidents too. To understand it, look at what was attacked, not just the logo on the case.

CryptoBilis is an authorised Ledger reseller in South East Asia (Indonesia, Malaysia, the Philippines). The timeline:

The reseller has suspended its hardware wallet A small device that holds the keys and signs transactions without ever showing them to the computer. Always check on its screen what you approve. sales during the investigation. Ledger says it is working with the authorities, reviewing controls on its authorised resellers, and has reminded them never to restock returned products.

According to the explanation Ledger published on 13 October, a chip hidden in the case reads what is sent to the screen while the 24 words of the recovery phrase The 12 or 24 words a wallet gives you when it is created: they rebuild your keys on another device. Whoever has them has your bitcoin: never give them to anyone. 5 mistakes to avoid are displayed during setup. It recognises and decodes the words, then sends them over the mobile network (LTE, using an eSIM).

That is the trap: the owner can write the backup on paper, never type it into a website or photograph it, and still have a device that spies on them.

In a usual setup, without an extra passphrase, those 24 words are enough to rebuild the keys on any other compatible wallet. A copy of the words therefore gives access to the same funds, without the original Ledger.

The secure chip (the Secure Element) did not need to be broken. According to Ledger, the implant modified neither the secure chip, nor the operating system, nor transactions or signatures: it is a physical supply-chain attack, not a flaw in Ledger’s software.

The Genuine Check verifies that the secure chip is authentic. But Ledger’s own documentation says so: it cannot detect unauthorised physical modifications to the hardware when the original chip is intact, nor verify the device’s journey before it reaches you. A device reported as genuine can therefore contain an addition.

On 13 October, Ledger also announced that sales were suspended at MediaMarkt Saturn, in stores and online, after a customer in Germany reported an implant. No loss of funds has been reported in that case, and Ledger has not confirmed a link to CryptoBilis.

So the reports cannot all be treated as one case that is already solved. It remains to be established where the modifications happened, how many devices are involved, and who is responsible.

If the subject draws such reactions, it is also because it comes on top of earlier stories. They are very different, and summing them all up as “Ledger got hacked” loses the point.

Data leak, hacked component, fake app, signing bug, modified device: five different situations, with different risks and different fixes.

In September 2026, Trezor announced an incident at Brevo, its email provider: 347,149 addresses of newsletter subscribers were exported. A fake message sent through that service, dressed up as a critical security alert, pushed people towards an app that asked for their wallet backup.

According to Trezor, no device, wallet or account was affected. The company took the malicious link down in about twenty minutes and suspended the service. The risk is still similar to the contact-data leaks around Ledger: one compromised provider is enough to target customers, even when the device itself works normally.

These examples show that several brands run into problems, at different links in the chain: providers, software, hardware, distribution. That does not make all products equal, and it does not take any maker off the hook. But believing that a new brand removes every risk is a mistake.

A hardware wallet keeps the keys away from a possibly compromised computer and lets you check operations on a dedicated screen. It also depends on a sales channel, apps and services you need to be able to trust. What we can ask of every brand:

• a clearly explained scope: which devices, which sales channels, which dates;
• fixes where possible, and audits;
• usable guidance for everyone, not just experts.

Ledger’s security bulletins (Donjon) also show detection and fixing work. And a flaw published by researchers is not automatically a theft seen at customers.

Match the response to the problem:

And never improvise a recovery with a stranger who messages you privately: after a case like this one, that is exactly what scammers are after.

The aim is not to condemn one brand or present another as invincible, but to understand the protections we use and their limits. Incidents around Ledger deserve to be explained, just like those affecting other makers. Security depends on the hardware, but also on the software, the distribution, and how each company responds when a problem is found.

For a miner it matters twice over: on FindMyBlock, as on any solo pool A server that machines connect to. A regular pool shares the earnings, a solo pool does not. Solo or pool?, a block reward goes straight to your wallet address. The day your machine finds one, that wallet receives it. To set up that address: solo mining on FindMyBlock.

A question? Ask it under the video or on Discord.