[{"data":1,"prerenderedAt":173},["ShallowReactive",2],{"i-mdi:hamburger-menu":3,"/blog/cryptobilis-ledger-wallet-incident-2026":8,"i-hugeicons:new-twitter":165,"i-hugeicons:telegram":167,"i-hugeicons:facebook-02":169,"i-hugeicons:reddit":171},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"currentColor\" d=\"M3 6h18v2H3zm0 5h18v2H3zm0 5h18v2H3z\"/>",{"id":9,"title":10,"author":11,"authorPic":12,"backfilledAt":13,"body":14,"category":154,"coverPics":24,"date":155,"description":156,"extension":157,"meta":158,"navigation":159,"path":160,"seo":161,"stem":162,"type":163,"__hash__":164},"blogs/blog/cryptobilis-ledger-wallet-incident-2026.md","CryptoBilis wallet theft: what Ledger confirmed","Malaysia Blockchain Association Team","https://api.dicebear.com/7.x/avataaars/svg?seed=mba-team-3","2026-11-04",{"type":15,"value":16,"toc":145},"minimark",[17,25,31,50,55,64,76,80,92,104,113,118],[18,19,20],"p",{},[21,22],"img",{"alt":23,"src":24},"Wallet security","/img/blog/gen/cryptobilis-ledger-wallet-incident-2026.svg",[18,26,27],{},[28,29,30],"strong",{},"Incident: 9 October 2026. Company response: 15 October 2026. Coverage reviewed: 4 November 2026.",[18,32,33,34,37,38,41,42,49],{},"Customers who bought Ledger hardware wallets through ",[28,35,36],{},"Malaysia-based reseller CryptoBilis"," reported stolen funds on ",[28,39,40],{},"9 October 2026",". Ledger subsequently confirmed an unauthorised hardware implant in an affected device. This was a physical tampering incident involving devices reaching customers through a reseller. ",[43,44,48],"a",{"href":45,"rel":46},"https://fintechnews.my/61364/blockchain/ledger-cryptobilis/",[47],"nofollow","Fintech News Malaysia reported the investigation on 12 October",".",[51,52,54],"h2",{"id":53},"what-ledgers-investigation-found","What Ledger's investigation found",[18,56,57,58,63],{},"In its ",[43,59,62],{"href":60,"rel":61},"https://www.ledger.com/blog-response-hardware-implant-attack",[47],"15 October response",", Ledger said attackers bought genuine devices, fitted hidden components that captured recovery phrases during setup, and returned the devices to distribution in Southeast Asia. Ledger said its chip, operating system and servers had not been compromised. Those are the manufacturer's findings, rather than a completed independent forensic assessment.",[18,65,66,67,70,71,75],{},"Ledger asked authorised resellers and distributors in ",[28,68,69],{},"Southeast Asia and Hong Kong to suspend sales",". Its revised handling rules prohibit reselling returned devices and require stock to be kept away from public shelves and displays. ",[43,72,74],{"href":60,"rel":73},[47],"Ledger's response"," sets out the changes.",[51,77,79],{"id":78},"loss-figures-need-a-date-and-an-attribution","Loss figures need a date and an attribution",[18,81,82,87,88,91],{},[43,83,86],{"href":84,"rel":85},"https://fintechnews.my/61511/blockchain/ledger-wallet-sales-suspended-southeast-asia/",[47],"Fintech News Malaysia's 15 October report"," cited Bitquery's estimate of ",[28,89,90],{},"US$102 million across 324 wallets",", while noting that Ledger had not independently confirmed the total. Earlier reports used lower figures. These estimates should not be presented as a final, manufacturer-verified loss tally.",[18,93,94,95,98,99,49],{},"The original ",[28,96,97],{},"9 October customer notice"," addressed purchases from CryptoBilis in the preceding 90 days: leave unused devices uninitialised, and follow Ledger's official guidance for moving assets from an already configured device to a new wallet with a fresh recovery phrase. That 90-day period was measured from the notice, not from the date someone reads this article. ",[43,100,103],{"href":101,"rel":102},"https://www.cryptured.com/ledger-cryptobilis-wallet-warning-fund-loss-investigation/",[47],"The notice was reported on 10 October",[18,105,106,107,112],{},"For current instructions, use ",[43,108,111],{"href":109,"rel":110},"https://support.ledger.com/",[47],"Ledger Support",". Never disclose a recovery phrase to anyone claiming to investigate or recover funds.",[114,115,117],"h3",{"id":116},"references","References",[119,120,121,130,137],"ul",{},[122,123,124,125,129],"li",{},"Ledger — ",[43,126,128],{"href":60,"rel":127},[47],"Response to the Hardware Implant Attack",", 15 October 2026.",[122,131,132,133,129],{},"Fintech News Malaysia — ",[43,134,136],{"href":84,"rel":135},[47],"Sales suspension across Southeast Asia and Hong Kong",[122,138,139,140,144],{},"Cryptured — ",[43,141,143],{"href":101,"rel":142},[47],"Ledger's initial customer precautions",", 10 October 2026, referring to the 9 October notice.",{"title":146,"searchDepth":147,"depth":147,"links":148},"",2,[149,150],{"id":53,"depth":147,"text":54},{"id":78,"depth":147,"text":79,"children":151},[152],{"id":116,"depth":153,"text":117},3,"News","2026-10-15","Ledger traces October wallet thefts to tampered reseller devices. The incident dates, company findings and third-party loss estimates explained.","md",{},true,"/blog/cryptobilis-ledger-wallet-incident-2026",{"title":10,"description":156},"blog/cryptobilis-ledger-wallet-incident-2026","blog","RDqRqNRQ7Evwt4DJxwqsNtjhTcY8QMo_VrviYDcZCKk",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":166},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"m3 21l7.548-7.548M21 3l-7.548 7.548m0 0L8 3H3l7.548 10.452m2.904-2.904L21 21h-5l-5.452-7.548\"/>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":168},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"m11.985 15.408l3.242 3.686c1.2 1.365 1.801 2.048 2.43 1.881c.628-.166.844-1.064 1.275-2.861l2.39-9.968c.665-2.768.997-4.151.259-4.834s-2.017-.175-4.575.84L5.14 8.865c-2.046.813-3.069 1.219-3.134 1.917a1 1 0 0 0 0 .214c.063.699 1.084 1.108 3.128 1.927c.925.371 1.388.557 1.72.912q.056.06.108.124c.306.38.436.88.697 1.876l.489 1.867c.253.97.38 1.456.713 1.522s.622-.336 1.201-1.141zm0 0l-.317-.33c-.362-.378-.543-.566-.543-.8s.18-.423.543-.8l3.573-3.724\"/>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":170},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linejoin=\"round\" stroke-width=\"1.5\" d=\"M6.182 10.333c-.978 0-1.182.192-1.182 1.111v1.667c0 .92.204 1.111 1.182 1.111h2.363v6.667c0 .92.205 1.111 1.182 1.111h2.364c.978 0 1.182-.192 1.182-1.111v-6.667h2.654c.741 0 .932-.135 1.136-.806l.507-1.666c.349-1.149.133-1.417-1.137-1.417h-3.16V7.556c0-.614.529-1.112 1.181-1.112h3.364c.978 0 1.182-.191 1.182-1.11V3.11C19 2.191 18.796 2 17.818 2h-3.364c-3.263 0-5.909 2.487-5.909 5.556v2.777z\" clip-rule=\"evenodd\"/>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":172},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.5\">\u003Cpath d=\"M15 17a5 5 0 0 1-6 0m9.5-12.5a1.5 1.5 0 1 1-3 0a1.5 1.5 0 0 1 3 0m-3 0C14.333 4.667 12 5.8 12 9\"/>\u003Cpath d=\"M12 21c4.418 0 8-2.686 8-6c0-.352-.043-.696-.12-1.031a2.498 2.498 0 1 0-2.652-3.508C15.824 9.55 13.997 9 12 9c-2 0-3.826.552-5.229 1.46A2.498 2.498 0 0 0 2 11.5a2.5 2.5 0 0 0 2.12 2.469Q4 14.472 4 15c0 3.314 3.582 6 8 6\"/>\u003Cpath d=\"M15.25 13H15m.5 0a.5.5 0 1 1-1 0a.5.5 0 0 1 1 0m-5.75 0H9.5m.5 0a.5.5 0 1 1-1 0a.5.5 0 0 1 1 0\"/>\u003C/g>",1793763397256]