Ledger is taking a hard look at how its hardware wallets reach customers. The French company is reviewing its device sales policies after spyware thefts caused $90 million in losses, Bloomberg reported.
Ledger SAS announced the review on October 13, 2026. It covers the company’s consumer device sales policies and processes, and it follows a supply-chain attack tied to one of its authorized resellers.
How the attack worked
The compromised devices were sold through CryptoBilis, an authorized Ledger reseller. The incident first surfaced around October 9, 2026.
Most affected units went to buyers in Southeast Asia. Malaysia, Indonesia, and the Philippines were the main markets hit.
The devices reportedly contained unauthorized hardware implants. These implants read the 24-word recovery phrase shown on the device screen during setup.
The implants then sent the captured phrases out over LTE using an eSIM.
Ledger’s Genuine Check protocol, designed to confirm a device is authentic, failed to detect the hidden implants after extensive analysis.
The damage, by the numbers
Loss estimates range from $72 million to over $93 million. Bloomberg put the figure at $90 million.
The thefts hit 315 wallets across six chains.
Tether froze approximately $10 million in USDT linked to the suspected thefts. Because USDT is issued by a central company, Tether can lock tokens at specific addresses, something that isn’t possible with assets like Bitcoin.
Ledger told recent buyers not to initialize unused devices. It also advised them not to migrate funds onto new hardware while the situation is assessed.
A reseller under new ownership
CryptoBilis changed hands in March 2026. The unauthorized implants were reportedly introduced after the new owner took over.
Ledger says no devices sold through its direct sales channels were compromised. The company is pointing to the reseller’s supply chain as the weak link.
Reports of similar implants have emerged from Europe, including devices sold at MediaMarkt, the electronics retailer.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.