A tampered-device scheme linked to reseller CryptoBilis reportedly swept funds from more than 300 wallets, including one holding $4.8 million in Bitcoin
A wallet holder described in a post on X as a crypto scammer lost over 60 BTC, worth $4.8 million, after a Ledger hardware wallet was compromised.
The loss was not a one-off. It sits inside a much larger supply-chain attack on Ledger devices sold through CryptoBilis, a Southeast Asian reseller. That attack reportedly drained hundreds of wallets in one coordinated burst.
Ledger confirmed it found an unauthorized hardware implant inside at least one affected device. The implant captured the 24-word seed phrase users wrote down during setup.
It then sent those phrases out over cellular networks. A seed phrase is the master key to a wallet. Whoever holds it can rebuild the wallet anywhere and move every coin inside.
Unusual activity surfaced around October 9, 2026. The drains happened fast that day, hitting multiple wallets within a matter of seconds, according to Ledger’s description of the strike.
Early loss estimates ranged from $72 million to $86 million. Those figures were later revised upward to between $93 million and $102 million across roughly 300-plus wallets.
Analysts tracking the collector addresses saw inflows in Bitcoin , Ethereum , TRON and stablecoins. Over 324 wallets were involved, per the research findings.
Bitcoin tallies also shifted as investigators dug in. Early counts showed about 211 BTC, totaling roughly $17.5 million. Other analyses put the figure at more than 203 BTC.
Individual losses were large. One victim reportedly moved about 80 BTC into a new Ledger shortly before the October 9 attack, a holding valued at approximately $4.8 million at the time.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
Another victim reported losing about 60 BTC. The X post tied the over 60 BTC loss, valued at $4.8 million, to the alleged scammer.
Tether froze about $10 million in USDT linked to the exploited addresses.
Ledger said every verified case traced back to purchases from CryptoBilis. The company stated that its own systems and direct sales channels remained secure.
Ledger characterized the perpetrators as a highly organized criminal group. According to the company, the group spent considerable effort building the implants before launching a coordinated strike.
As of mid-October 2026, Ledger was still publishing updates for users. It focused on customers who bought devices from CryptoBilis within the last 90 days.
The company urged caution during device setup and when moving assets to a new seed phrase. That second warning matters. Generating a fresh seed on a compromised device simply hands the attackers a new key.
The attackers did not drain wallets the moment seed phrases came in. Instead, they appear to have waited while victims loaded funds, then struck many wallets almost simultaneously. The 80 BTC victim reportedly deposited shortly before the attack.
This approach maximizes the haul and minimizes warning. If the group had emptied wallets one by one, early victims could have raised alarms and saved later ones.
The research findings suggest the event could weaken consumer confidence in hardware wallet safety and self-custody more broadly. With an estimated $102 million taken within hours, that concern is not abstract.
The findings also flag possible regulatory scrutiny and louder demands for manufacturer accountability. Ledger has drawn a clear line around its own channels, but customers who lost funds may not find that distinction comforting.
There is a practical checklist for anyone holding a device from a third-party seller. Check the purchase source and date against Ledger’s 90-day guidance. Be wary of any device that arrived with packaging or components that seem off.