Key TakeawaysLedger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from SouthKey TakeawaysLedger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from South
Ledger Hack Explained: Hardware Implant Found in CryptoBilis-Sold Wallet as Losses Near $93 Million, and How to Protect Your Device
Key Takeaways
Ledger confirmed on Saturday, October 10, 2026, that "one of the impacted users' devices contained an unauthorized hardware implant," after buyers who purchased devices from Southeast Asian reseller CryptoBilis reported drained wallets.
Onchain estimates of the losses range from more than $72 million to about $93 million. Blockchain analytics firm Bitquery counts more than 300 victim wallets, most on TRON and Bitcoin, drained within hours on October 9. Ledger has not confirmed a figure.
Ledger says it has "no indication" its own systems were compromised. The evidence points to a supply chain attack through a single official reseller covering Indonesia, Malaysia and the Philippines, which has suspended sales.
Anyone who bought a Ledger from CryptoBilis in the last 90 days should not set it up. If it is already in use, Ledger advises moving funds to a new device with a newly generated recovery phrase.
The thief is laundering through Tornado Cash, cross-chain swaps and the USDD stablecoin, while Tether has frozen about $10 million in USDT linked to the theft.
What Happened
The first warnings came from users. On October 9, Ledger owners in Southeast Asia began reporting on X and Reddit that their wallets had been emptied, and onchain investigators quickly linked the victims to devices bought through CryptoBilis, a Kuala Lumpur-based company listed on Ledger's official reseller directory for Indonesia, Malaysia and the Philippines. Researcher tanuki42 traced more than $72 million to suspected theft addresses, investigator Specter put the figure above $86 million across Bitcoin, Ethereum and TRON, and MistTrack cited almost $90 million.
The most detailed count so far comes from Bitquery, which tallies about $93.2 million taken from 315 victim wallets across six chains, led by TRON at about $70.5 million and Bitcoin at $16.8 million. Its timeline suggests careful preparation. The attacker's control addresses were funded on September 25 and ran test transactions until October 7. Then, early on October 9, the attacker added a new key to 30 TRON wallets, locking out their owners, and began draining at about 05:07 UTC, hitting five chains within 47 minutes.
Ledger Confirms a Hardware Implant
On Friday, Ledger said it was investigating and asked CryptoBilis to pause all sales and shipments. On Saturday it went further: "Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The company added, "We have no indication that Ledger's security infrastructure, systems or services have been compromised." Ledger says it is working with law enforcement, has thanked the SEAL 911 incident response group for its help, is contacting affected users, and is developing additional protections against physical tampering. It has not said how many devices contain implants or whether the implant explains every drained wallet.
Independent teardowns point the same way. Mark Karpelès, the former Mt. Gox CEO, reported a tiny component, about two by two millimeters, hidden near the screen of a Ledger Nano X that arrived from Malaysia in apparently intact shrink-wrap, and said "the only way to detect the implant is to open the device." Security firm Tibane Labs described a microcontroller and cellular hardware wired to the screen's data lines, consistent with a device that could read a recovery phrase as it is displayed during setup and send it out. Ledger has not confirmed that analysis. A separate claim from a buyer in Europe about a tampered device has not been verified, and observers disagree about the photos.
Why This Is a "Ledger Hack" That Did Not Hack Ledger
Searches call it the Ledger hack, but the evidence so far describes a supply chain attack: devices modified somewhere between the factory and the customer, not a flaw in Ledger's chips, firmware or servers. Binance co-founder Changpeng Zhao said the available information pointed to a supply chain attack at a single vendor and reminded users that "self-custody comes with extra responsibilities." CryptoBilis has suspended sales of its hardware wallet inventory until the investigation concludes and remains in contact with Ledger, which has made no accusation against the reseller. The incident follows the Coldcard wallet hack and the Trezor and SafePal data leaks earlier this year, and it shows that the security of a hardware wallet depends on where it came from as much as on the brand.
Where the Stolen Funds Went
The laundering began within hours. According to Bitquery, 1,254 ETH went through Tornado Cash on October 9, about 20 million USDT was bridged to Ethereum and swapped for ETH, and roughly $15 million was converted into USDD, a TRON-based stablecoin that Tether cannot freeze. Swap services including Relay, Chainflip and NEAR Intents carried more. Tether blacklisted 37 linked addresses and froze about $10 million in USDT, but as of October 10 about $16.8 million in Bitcoin sat unmoved and roughly $40.9 million was held as ETH in the thief's wallets.
What Ledger Owners Should Do Now
- Bought from CryptoBilis in the last 90 days and not set up yet: do not set it up. Ledger's words: "We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up."
- Already using a CryptoBilis device: "consider moving assets to a new Ledger signer (with new seed)," as Ledger advises, using a device bought directly or from a verified reseller.
- Any hardware wallet: reject a device that arrives with a pre-printed recovery phrase, confirm that a new phrase is generated on first start, and treat unusually low prices or unexpected shipping origins as warning signs.
- Never share your 24-word recovery phrase. Ledger "will never ask users to disclose their 24-word recovery phrase," and fake recovery services typically follow incidents like this one.
- If you were drained: save the transaction hashes, contact SEAL 911, file a police report, and notify Tether if USDT was taken.
What It Means for Traders on MEXC
Hardware wallets remain one of the safest ways to hold crypto long term, but this incident is a reminder that the chain of custody matters as much as the device. Traders who move funds between MEXC and a hardware wallet can reduce risk by buying devices only from the manufacturer or verified resellers, testing a new wallet with a small withdrawal first, and using two-factor authentication, an anti-phishing code and a withdrawal address whitelist in their MEXC security settings.
Disclaimer: This content is for educational and reference purposes only and does not constitute any investment advice. Digital asset investments carry high risk. Please evaluate carefully and assume full responsibility for your own decisions.
Возможности рынка
NEAR Курс (NEAR)
$5.5001
$5.5001$5.5001
USD
График цены NEAR (NEAR) в реальном времени
Статьи, размещенные на этой странице, взяты из открытых источников и представлены исключительно для информационных целей. Они не отражают позицию или взгляды MEXC. Все права принадлежат OoJae. Если вы считаете, что какой-либо контент нарушает права третьей стороны, пожалуйста, свяжитесь с service@support.mexc.com для оперативного удаления. MEXC не гарантирует точность, полноту или своевременность любого контента и не несет ответственности за любые действия, предпринятые на основе предоставленной информации. Содержание не является финансовым, юридическим или другим профессиональным советом, а также не должно интерпретироваться как рекомендация или одобрение со стороны MEXC. Для получения экспертных мнений и углубленного анализа посетите MEXC Обучение.
Узнайте больше о NEAR
Подробнее
Ставка повышена, BTC достиг максимума за 8 месяцев – негатив уже учтен в цене или это ралли на фоне шорт-сквиза? | Еженедельный аналитический обзор MEXC Alpha Trader
Третья неделя сентября 2026 г. Период сбора статистики: 16–22 сентября 2026 г. Дата окончания сбора данных: 22 сентября 2026 г. Основная тема За прошедшую неделю криптовалютный рынок прошел полный цик
2026/09/23
Прогноз цены акций Nvidia: не начал ли бум ИИ съедать собственную прибыль Nvidia?
Nvidia только что третий квартал подряд удержала валовую маржу вблизи 75%. И в том же пресс-релизе компания понизила прогноз по этому показателю. Выручка по-прежнему ускоряется — 96,2 млрд долларов за
2026/08/27
Спотовая торговля биткоином около 80 000$: что следует знать новым трейдерам
Недавнее движение биткоина к 80 000$ привлекло новую волну внимания к торговле BTC. Однако для новичков одно различие должно стоять перед любым прогнозом цены: Спот-торговля — это не то же самое, что
2026/08/25
Последние новости о NEAR
Подробнее
Всплеск опционов SpaceX: импульс IPO превращается в проверку волатильности
Ралли SpaceX после IPO перестало быть просто историей стартового спроса. После оценки в 135 долларов и быстрого роста выше 200 долларов рынок вошел в фазу критического тестирования. Рекордная активность по опционам в первый день превратила SpaceX в инструмент, движимый деривативами, где хеджирование дилеров и волатильность значат не меньше, чем долгосрочная стратегия компании.
2026/06/17
Обзор доходов Nvidia за Q1 FY2027: выручка дата-центров достигла $75,2 млрд, а маржа ИИ-чипов удерживается на уровне 75%
Nvidia опубликовала финансовые результаты за первый квартал 2027 финансового года 20 мая 2026 года, продемонстрировав абсолютно доминирующий и безупречный отчет за квартал, завершившийся 26 апреля 2026 года. Чип-гигант зафиксировал рекордно высокую общую выручку в размере $81,6 млрд, что на 85% больше в годовом исчислении. Главным драйвером роста вновь стал сегмент дата-центров, принесший $75,2 млрд выручки и показавший стремительный взлет на 92% по сравнению с аналогичным периодом прошлого года. Несмотря на масштабное расширение производственных мощностей, Nvidia полностью сохранила свою ценовую силу: валовая маржа по GAAP и non-GAAP составила невероятные 74.9% и 75.0% соответственно.
Этот отчет доказал, что глобальный спрос на искусственный интеллект — это не просто абстрактный нарратив, он напрямую конвертируется в высокомаржинальную выручку в беспрецедентных масштабах. Для инвесторов, отслеживающих последние рыночные тенденции, результаты первого квартала задают очень высокую планку для следующего отчетного цикла Nvidia, проверяя, сможет ли бум ИИ-инфраструктуры поддерживать такие темпы без столкновения с ограничениями цепочки поставок или падением маржи.
2026/07/09
Mastercard завершает приобретение BVNK на сумму до 1,8 млрд $ — стейблкоины выходят в ядро глобальных платежей
Mastercard завершила приобретение поставщика инфраструктуры стейблкоинов BVNK 3 августа 2026 года после объявления о сделке в марте.
2026/08/04
Вам также может быть интересно
В тренде
Трендовые криптовалюты, которые в настоящее время привлекают значительное внимание рынка
Цены на криптовалюту
Криптовалюты с наибольшим объемом торгов
Недавно добавленные
Криптовалюты недавно внесенные в листинг и доступные для торговли