Incident: 9 October 2026. Company response: 15 October 2026. Coverage reviewed: 4 November 2026.
Customers who bought Ledger hardware wallets through Malaysia-based reseller CryptoBilis reported stolen funds on 9 October 2026. Ledger subsequently confirmed an unauthorised hardware implant in an affected device. This was a physical tampering incident involving devices reaching customers through a reseller. Fintech News Malaysia reported the investigation on 12 October.
What Ledger's investigation found
In its 15 October response, Ledger said attackers bought genuine devices, fitted hidden components that captured recovery phrases during setup, and returned the devices to distribution in Southeast Asia. Ledger said its chip, operating system and servers had not been compromised. Those are the manufacturer's findings, rather than a completed independent forensic assessment.
Ledger asked authorised resellers and distributors in Southeast Asia and Hong Kong to suspend sales. Its revised handling rules prohibit reselling returned devices and require stock to be kept away from public shelves and displays. Ledger's response sets out the changes.
Loss figures need a date and an attribution
Fintech News Malaysia's 15 October report cited Bitquery's estimate of US$102 million across 324 wallets, while noting that Ledger had not independently confirmed the total. Earlier reports used lower figures. These estimates should not be presented as a final, manufacturer-verified loss tally.
The original 9 October customer notice addressed purchases from CryptoBilis in the preceding 90 days: leave unused devices uninitialised, and follow Ledger's official guidance for moving assets from an already configured device to a new wallet with a fresh recovery phrase. That 90-day period was measured from the notice, not from the date someone reads this article. The notice was reported on 10 October.
For current instructions, use Ledger Support. Never disclose a recovery phrase to anyone claiming to investigate or recover funds.
References
- Ledger — Response to the Hardware Implant Attack, 15 October 2026.
- Fintech News Malaysia — Sales suspension across Southeast Asia and Hong Kong, 15 October 2026.
- Cryptured — Ledger's initial customer precautions, 10 October 2026, referring to the 9 October notice.