Reports have been increasing that users of the Ledger crypto wallet have seen their accounts depleted, and it appears to be related to manipulated hardware sold by CryptoBillis. Ledger has asked CryptoBillis to suspend all sales from its wallets while it conducts an investigation. Ledger has confirmed that “one of the affected users’ devices contained an unauthorized hardware implant.”
Photos and videos posted on X and Threads appear to show a small circuit board located under the screen. The implant supposedly intercepts everything displayed on the screen, including the initial passphrase displayed during initial setup. Using an embedded SIM card, the implant sends that information to the attacker, who can then siphon funds from users’ accounts.
Reports indicate that whoever is behind the hack has stolen over $86 million worth of cryptocurrency from hundreds of wallets. There is no indication that Ledger’s systems have been compromised or that wallets purchased directly from the company have been affected. Instead, the issue appears to be a supply chain attack primarily involving Southeast Asian users and the CryptoBillis reseller. Ledger has provided guidance on how to check if your wallet has been tampered with.
Update October 10, 2026: Added additional statement from Ledger.
