Short answer
Ledger said on 9 October 2026 that devices sold by its Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, and on 13 October that all confirmed fund losses it had linked to the incident involved that reseller. On 30 October Trezor said it had received a credible report of a similar implant in a Trezor Safe 5 bought from CryptoBilis.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | CryptoBilis (Ledger and Trezor reseller) |
|---|---|
| Incident type | Supply-chain compromise |
| Status | Under investigation |
| Sector | Cryptocurrency hardware wallets |
| Country | Southeast Asia |
| Detected | 2026-10-09 |
| Disclosed | 2026-10-09 |
| People or records affected | Customers who bought Ledger or Trezor devices from CryptoBilis; SecurityWeek reports at least $86 million stolen from multiple users, which Ledger has not confirmed |
What data was exposed
- Wallet recovery phrases (seed words) shown on screen during setup, reportedly read and transmitted over LTE by a hidden implant
- Cryptocurrency stolen from wallets set up on tampered devices
- Ledger says the implant intercepts information only and does not change the device's operating system, transactions or signatures
What happened
On 9 October 2026, Ledger began investigating fund losses among customers who bought hardware wallets from CryptoBilis, its authorized reseller in Southeast Asia. Ledger asked CryptoBilis to stop selling its devices and told customers to stop using them. SecurityWeek reported on 13 October that Ledger had confirmed some signers were physically tampered with in a supply-chain attack, and that all confirmed fund losses it had linked to the incident involved a signer sold through CryptoBilis.
Ledger’s advice, as quoted by SecurityWeek: users who bought from the reseller in the last 90 days who have not set up the device should not start; anyone who has should “consider moving assets to a new Ledger signer (with new seed).”
How the implant works
Ledger said the implant “sits inside the enclosure and reads the data shown on the screen.” When it detects the recovery phrase screen during setup, its microcontroller “decodes the words and transmits them over LTE” using a provisioned eSIM. Ledger says the implant was built to intercept information only. It does not alter the device’s operating system, transactions or signatures. SecurityWeek reports that a post on X suggested someone in the distribution chain soldered the part onto the circuit boards. That is an inference from the post, not a finding by Ledger.
The Trezor report
CryptoBilis was also an authorized Trezor reseller. Trezor says it removed the company on 9 October and has been investigating since. On 28 October its security team received a responsible disclosure about a Trezor Safe 5 bought from CryptoBilis in August 2026 via Tokopedia. The reporter described an extra circuit board between the main board and the screen with a cellular module and antenna that reads screen content, including the wallet backup, and sends it over a mobile network when the device is plugged in.
Trezor has not received the device, so it has not verified this. It treats the report as credible based on the description, photos and a video interview, and the device is being sent to its lab. Trezor says no funds have been reported stolen and no CryptoBilis buyer has reported a loss. The reporter moved funds off the device before finding the implant.
What is not known
The number of affected users and total losses are unconfirmed. The $86 million figure comes from SecurityWeek citing an on-chain investigator, and Ledger has not confirmed it. Neither company has said who is behind the implants, and Trezor declined to draw comparisons with Ledger’s case until it examines the device.
What owners are told to do
Trezor’s guidance applies to every Trezor model bought from CryptoBilis from March 2026 onward. If you already use one, move funds to a new wallet with a new seed as soon as possible, and check the full receiving address before sending. If you have not set it up, do not. Eligible customers can get a replacement or a voucher.
Expect impostors. See our guide to crypto wallet drainer and fake airdrop scams, recovery scams and the data breach checklist.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake Ledger or Trezor 'security check' emails, letters and calls that ask for your recovery phrase. Neither company will ask for it.
- Impostors offering to 'recover' stolen crypto for an upfront fee.
- Fake replacement or voucher offers that send you to a look-alike support site.
- Look-alike hardware wallets sold on marketplaces at a discount, which may also be tampered with.
What to do if you are affected
- 01Check where your Ledger or Trezor came from. If it was bought from CryptoBilis, or from a store supplied by it such as its Tokopedia shop, treat it as compromised.
- 02If you have not set it up, do not set it up, and never enter an existing wallet backup on it.
- 03If you already use it, move your assets to a new wallet with a new seed, created on a new device from an official source. Restoring the old backup elsewhere does not fix the problem.
- 04Never share your recovery phrase with anyone. Contact Ledger or Trezor only through their official sites.
- 05Eligible Trezor customers should keep the CryptoBilis device and contact Trezor Support about a replacement or voucher. Ledger buyers should follow Ledger's guidance.
Frequently asked questions
Which devices are affected?
Ledger signers sold through CryptoBilis, and, per Trezor, any Trezor model bought from CryptoBilis from March 2026 onward, including through stores it supplied. Trezor says it has no reports involving other resellers or regions.
How does the implant work?
Ledger says it sits inside the enclosure and reads what the screen displays. When the 24-word recovery phrase appears during setup, its microcontroller decodes the words and sends them over LTE. For the Trezor, the reporter described an extra board with a cellular module between the main board and the screen. Trezor has not yet examined that device.
How much was stolen?
SecurityWeek reports at least $86 million from multiple users, citing on-chain investigator Specter. Ledger has not confirmed the number of affected users or the total. Trezor says no funds have been reported stolen from its devices.
Is a weight check enough to spot an implant?
No. Trezor says the reporter noticed a weight difference, but a scale cannot reliably confirm or rule out tampering.
Sources
- Implant reported in a Trezor sold by CryptoBilis, Trezor, 2026-10-30
- $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant, SecurityWeek, 2026-10-13
This post summarises public reporting as of 2026-11-06. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.