CryptoBilis exploit analysis

The October 2026 drain of more than 300 Ledger hardware wallets traced back to a supply-chain compromise at CryptoBilis, a Malaysia-based reseller operating across Indonesia, Malaysia and the Philippines. On-chain researchers put the losses at $86 million to $93 million across Bitcoin, Ethereum and Tron. Ledger has confirmed the incident but described the affected volume as "limited" and said its internal systems and direct sales channels were not compromised.

What the implant does

Third-party researchers disassembled affected devices and found a chip and antenna added inside the Ledger housing, positioned to capture the seed phrase as it was generated and to transmit it over a cellular connection. CoinDesk reported that at least one device "contained an unauthorized hardware implant." Mark Karpelès, formerly of Mt. Gox, photographed a later variant concealed behind the screen with the antenna cable routed around existing components.

The implant does not need a foothold on the host machine. Once a user initializes the device, the seed is exfiltrated at generation time, before any software on the user's computer is involved. Standard mitigations such as passphrase-protected seeds reduce the impact only if the attacker does not also capture the passphrase entry, which a cellular transmitter can in principle log.

Supply-chain footprint

CryptoBilis suspended sales after Ledger asked it to on October 9. Researcher reports suggest tampered units were available for nearly half the price of legitimate stock, consistent with a wholesale-level compromise rather than a retail swap. The geographic pattern of victims points strongly to its Southeast Asian distribution channel, though one European user later reported a similar implant on a device bought outside the region. Ledger has recommended that any customer who purchased from CryptoBilis move funds to a new seed on a device obtained directly from Ledger.

Where it sits in the corpus

Hardware wallet compromises have surfaced before. The Coldcard incident in August 2026 involved a different vector: a flaw in the wallet's signing code that allowed funds to be drained from existing devices without physical tampering. The CryptoBilis case is closer to a 2018-class problem in which compromised devices reach end users through a single reseller. The combination of a cellular exfiltration channel and a price discount visible to buyers is unusual, and explains why losses mounted across more than 300 separate wallets before detection.