$86 million, stolen from the box
Hardware wallets have always been regarded as the "ultimate safe" for crypto assets. Private keys never touch the internet, secure elements resist extraction, PIN codes provide physical protection—for the past decade, this narrative has been almost an industry consensus.
But on October 9, 2026, a crack was torn in that consensus.
That day, on-chain detective Specter detected a surge of reports on X and Reddit from Ledger users whose wallets had been drained. Tracing it down, the addresses involved aggregated funds across multiple chains including Bitcoin, Ethereum, and Tron, with cumulative losses exceeding $86 million to $93 million. Ledger subsequently confirmed: all verified cases pointed to devices sold by Southeast Asian distributor CryptoBilis. More critically, an unauthorized hardware implant was found in one affected device.
This was not a code vulnerability, not a phishing link, and not user error. This was a precision supply-chain attack launched from the physical layer. The attackers did not try to break Ledger's cryptographic system; instead, they chose to put something extra in the box before the device reached your hands.
Part 01 - The private key didn't leak, but the mnemonic was "seen"
The security logic of a hardware wallet is simple: the private key is generated inside the secure element and never comes out. The 24 mnemonic words you write down are the only credential for restoring the wallet—as long as they don't leak, the assets are safe.
The viciousness of this attack lies in this: it never intended to break the secure element. It targeted the place the secure element cannot control—the screen.
1. How did the attack happen?
Former Mt.Gox CEO Mark Karpelès opened a device with intact packaging and found a small module under the screen padding: a microcontroller connected to the screen's SPI data line, an LTE module with an eSIM, and an antenna.
This module is the most critical link in the entire attack chain. We broke down its operating logic into six steps:
❶ The mnemonic is normally generated inside the secure element (SE)
❷ The device displays the mnemonic on the screen for you to write down
❸ The malicious module taps into the screen data line (such as SPI) and synchronously intercepts the screen output
❹ It fully records the 24 mnemonic words
❺ It sends the mnemonic to the attacker via LTE / eSIM
❻ The attacker obtains the mnemonic and directly empties the assets.
2. Why can't genuine-device verification catch it?
The key point is: Ledger's genuine-device verification passes.
The secure element is real, the mnemonic is real, and the signature is real. The malicious module only eavesdrops when the screen refreshes and does not touch any data flow of the secure element. Your device is completely genuine at the "digital level," but at the "physical level" it has already been fully exposed.
The essence of the problem lies exactly here: the secure element can only ensure that the private key cannot be read or exported, but it cannot stop someone from directly "photographing" the screen. The private key never left the device, yet in the few seconds after the mnemonic was generated, it was completely copied away by a line attached to the screen data line.
3. This is not an isolated case, but a "production-line job" that has already gone through three generations
What is even more chilling is that this implantation scheme is not a handmade job improvised by some individual.
First generation: obvious handmade traces
Early modifications relied on manually soldered thin wires, with flying leads attached directly to the original circuit. To make room for extra components, the battery was replaced with a smaller-capacity, smaller-size model.
Caption: First-generation implant—manually soldered flying leads, with the battery replaced by a smaller model. (Source: Tibane Labs)
Second generation: switched to flexible circuit boards, simplified wiring
By the second generation, the implant was replaced with a bendable thin custom circuit board, and the large amount of exposed wiring from the early stage was greatly simplified, making assembly easier. But the battery still had to be replaced with a low-capacity version to make room for the implant.
Caption: Second-generation implant—a flexible circuit board replaced flying leads, but the battery still had to be swapped for a smaller one. (Source: Tibane Labs)
Third generation: the generation closest to "factory-original"
The third generation is currently the most covert version. When the casing is opened, the original battery, original motherboard, and original buttons are all there, looking no different from an ordinary Nano X. The only flaw is a thin black antenna added along the top edge of the casing.
Caption: Third-generation implant—the original battery and motherboard remain untouched, with only a black antenna line added along the top of the casing. (Source: Mark Karpelès)
This design is clearly aimed at batch assembly—not an individual handmade modification, but an attack chain with R&D, iteration, and supply-chain organizational capability.
Part 02 - Where the stolen funds went: a tracking window that is closing
After funds are stolen, the possibility of recovery decays rapidly over time.
1. The attackers are already laundering money
The attackers are laundering money very quickly. According to Bitquery on-chain tracking, the total amount of stolen funds is about $93.2 million, distributed across 315 wallets on 6 chains. The Tornado Cash route alone processed about 2,990 ETH, which after withdrawal was further moved into the Zcash privacy pool. Meanwhile, Tether froze about $10 million in involved USDT, and the attackers immediately converted part of the USDT into USDD—a Tron stablecoin that Tether cannot freeze.
Freeze what can be frozen first, and hurry to launder the rest. This is a very typical operation.
Schematic of on-chain flow of stolen funds. (Source: Bitquery report)
2. Layered laundering: first aggregate, then split, then mix
From Bitquery's tracing diagram, it can be seen that victims' funds were first split into multiple transfers, dispersed into multiple hacker addresses, and then further laundered through instant exchange services such as ChangeNOW and FixedFloat. Each amount was deliberately split to avoid triggering risk controls.
This is the typical "first aggregate, then split, then mix." Once funds enter this process, the difficulty of tracking rises exponentially.
Freezing ≠ recovery
It should be noted that: frozen USDT does not equal recovered funds. Freezing only prevents transfer; return still requires the full process of investigation, verification, and law-enforcement coordination. At present, about 700 ETH still remains untouched in the original address, most likely waiting for a better money-laundering opportunity.
Part 03 - How to determine whether the Ledger in your hands has been tampered with
If you have a Ledger, especially one bought from a third-party channel, the following items are worth checking one by one.
1. First pass the software check, then look at the setup process
Connect Ledger Wallet and run the genuine check in "My Ledger." A genuine device can connect to the official server through cryptographic proof.
But note: passing verification ≠ the physical layer has not been tampered with. This is precisely the core lesson of this incident.
Ledger's official criteria are very clear: users who purchased devices from CryptoBilis within the past 90 days should not set up devices that have not yet been initialized; those that have already been set up should consider moving assets to a new Ledger signer and using a brand-new mnemonic.
If any of the following occurs during setup, stop using it immediately:
· The device was already initialized when you received it, with an existing PIN or an existing wallet.
· The packaging includes a printed or written mnemonic card—genuine Ledger never preloads mnemonics.
· Any website, QR code, or paper card asks you to enter or use a mnemonic it provides.
2. Physical inspection: open it and look, or inspect without opening
Opening the device will void the warranty and may damage the circuit board due to static electricity, so caution is required.
For removable models such as the Nano X, a genuine unit should carry an STM32WB35 chip, and there should be no extra chips on the circuit board. If an extra module, wire, or chip appears under the screen padding, stop using it immediately.
For non-removable models such as Ledger Stax, Flex, and Nano Gen5, check the edges of the casing for cracks, cuts, or gaps. But do not be too confident in "intact casing"—a device with a flawless shrink-wrap film can still have been tampered with.
3. Advanced verification (technical users)
You can use the ledgerblue tool to run secure element attestation verification:
But this can only verify that the secure element is genuine; it cannot detect hardware implants at the screen level.
Part 04 - For Ledger users: please act immediately now
If you have bought a Ledger from CryptoBilis, or are unsure of the device's origin, act according to the following priorities.
1. If you have already set it up and stored assets: migrate immediatelyLedger's exact words were: "If you have already set up your Ledger device, consider moving your assets to a new Ledger signer (using a new mnemonic)." The core points are just two: a new signer, and a new mnemonic. Do not reuse the 24 words from your old device, and don't think "I'll just leave it for now and watch."
When migrating, note:
· The new device must use a brand-new mnemonic.
· The new device should ideally be bought directly from Ledger's official website, skipping all third-party channels.
· After migration is complete, do not touch the old device for any asset-related operations.
2. If you haven't initialized yet: do not initialize
Keep the device powered off, do not enter any information, and do not connect it to any application. CryptoBilis has suspended the sale and shipment of all hardware wallet inventory, and the investigation is still ongoing.
3. If you bought from another reseller: stay vigilant
Darkfost mentioned that other potentially related reseller names have also appeared in the community, including some Lazada merchants. Although this is speculation, the risk window is worth being alert to.
Ledger also reminded resellers: only procure through authorized channels, never relist returned products, and advised users not to buy from unauthorized resellers—"the risk of suspicious, counterfeit, or tampered devices is very high, and these devices do not operate under Ledger's security guidelines."
CZ had a practical suggestion: after buying a hardware wallet, wait a few weeks before transferring large amounts of assets. During this time, keep an eye on related news. If a batch of devices was tampered with before reaching the reseller, on-chain analysts need time to discover the first wave of thefts—during this "quarantine period," what you're buying is the information gap.
⚠️ Special note: scammers are exploiting the panic for a "second harvest"
After a real attack occurs, scammers immediately follow up. Fake accounts such as "Ledger. Notify" (@NotifyLedger) have already appeared, forging verification badges, avatars, and social relationships, spreading false warnings that "410,000 devices are at risk," and directing users to click phishing links such as incident-ledger.com.
Please only recognize the two official channels @Ledger and @Ledger_Support. Ledger official will not proactively ask for your mnemonic, nor will it ask you to "verify security" through unofficial links.
Conclusion
The core lesson of this incident is not that "Ledger is no longer secure," but that—the security boundary of a hardware wallet is much larger than you think.
The secure element protects the private key from being extracted digitally. But it cannot protect the screen, cannot protect the packaging, and cannot protect the logistics chain from the factory to your hands. When attackers choose to act at the physical layer, even if the device in your hands passes all software checks, it may still be a "fully exposed machine."
As of October 12, Ledger is still contacting affected users, and CryptoBilis's sales and shipments have both been suspended. The official window given is 90 days—if you bought a device from this reseller within this window, whether or not it has already been set up, it is recommended that you reassess your asset security.
The Zero Time Technology security team has long focused on crypto asset security and on-chain threat tracking. If you have been affected by this incident, we can provide:
· On-chain fund tracking: multi-chain path analysis, identifying consolidation addresses, mixer entry points, and exchange deposit points, providing technical grounds for freeze requests and reporting to authorities.
· Device security assessment: assisting in determining whether a Ledger device shows signs of physical tampering and assessing asset exposure risk.
· Emergency response recommendations: based on your specific situation, providing asset migration plans and security hardening recommendations.
The freedom of self-custody comes with the cost of self-custody. The defense line at the code level is already strong enough, so attackers will turn to the physical layer—and that defense line is yours to guard.