Ledger Confirms Implant in CryptoBilis-Sold Device as Bitquery Counts $93.2 Million Stolen

A thief emptied 315 crypto wallets of $93.2 million on Oct. 9, according to blockchain analytics firm Bitquery, and Ledger says "all confirmed cases" involve devices sold through CryptoBilis, one of its authorized resellers in Southeast Asia. Ledger makes hardware wallets, small devices that keep the keys to a person's crypto off the internet. On Oct. 10 it said one victim's device "contained an unauthorized hardware implant."

The attack goes after the one moment a hardware wallet cannot fully protect: setup, when the device shows its owner the master key. Le Coin's view is that the loss falls on reseller buyers, and the cost to Ledger is trust in its sales network.

What Ledger has confirmed

At 9:32 a.m. ET on Oct. 9, Ledger's support account said it was "investigating reports of loss of funds from users in South East Asia" and had asked CryptoBilis "to pause all sales and shipments of Ledger devices." At 12:54 p.m. ET its main account added: "we believe the funds drained are limited to devices sold through a reseller named CryptoBilis in South East Asia."

At 1:09 p.m. ET on Oct. 10 the support account wrote: "Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant." It said CryptoBilis "confirmed it has ceased sales of all hardware wallet inventory," thanked SEAL 911, a round-the-clock crypto incident-response team, and said: "We have no indication that Ledger’s security infrastructure, systems or services have been compromised."

Ledger's 72-hour update, at 1:13 p.m. ET on Oct. 11, said "The volume of impacted devices is limited," with no count. It told resellers to "source products only through authorized channels and never to restock returned products." Ledger's reseller directory still lists CryptoBilis under Indonesia and Malaysia, marked "Sales temporarily paused," as of 11:42 p.m. ET Oct. 11. A Sept. 20 archive copy also listed a Philippines entry, now gone.

The secure chip guards the key until the screen shows it

A Ledger's recovery phrase, or seed, is 24 words that rebuild the wallet on any device. Ledger's support pages say the words are generated inside the secure element, a tamper-resistant chip of "the same type of chip used in passports," and that private keys "never leave the device."

They do reach the screen once. Setup displays the 24 words so the owner can write them down, and Ledger says the screen "is driven directly by the Secure Element." Le Coin's read: whatever can tap that display line can read the seed.

Researchers have documented such implants. Hardware researcher Joe Grand and Tibane Labs have taken apart implanted Nano X units in which a small board "listens to the wire between the secure element and the screen," reads the 24 words and sends them over a cellular modem with an eSIM, a built-in SIM chip. Tibane writes that it has "not tested any device sold by CryptoBilis."

Ledger has not described the implant it found. The screen-and-eSIM design has not been tied to any CryptoBilis device.

Ledger's authenticity test would not catch such a board. Its Donjon security team writes that the Genuine Check "cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact."

Bitquery's chain data points to one thief holding every key

According to Bitquery, 25 TRON wallets signed the same transfer approval within three seconds at 1:07 a.m. ET on Oct. 9, and 111 Bitcoin wallets were emptied in one block at 1:54 a.m. ET. Le Coin confirmed one of the TRON transfers: 7,001,000 USDT from a single wallet at 1:07:54 a.m. ET.

On mempool.space at 11:44 p.m. ET Oct. 11, the two public Bitcoin drain addresses showed 203.79 BTC received and none spent, matching Bitquery's count. On TRON, according to Bitquery, 131 victim wallets lost 70.2 million USDT; Le Coin counts 71.16 million USDT flowing into nine drain addresses from 141 senders, a gross figure that may include non-victims.

Fig. 1. Money taken from victim wallets, by chain, Oct. 9, 2026, according to Bitquery (Source: Bitquery, figures verified Oct. 11, 2026; U.S. dollars at Bitquery's Oct. 9 morning prices. Le Coin's own checks shown separately.)

Ledger's Oct. 9 advice covered buyers "in the last 90 days"; its later posts set no time limit. According to Bitquery, 6 in 10 victim wallets on TRON, Bitcoin and Ethereum first got coins inside that window, and more than 8 in 10 from June on.

Bitquery's count runs past the public address lists

According to Bitquery, the ten drain addresses that on-chain researchers posted publicly on Oct. 9 took $85.4 million on Bitcoin, Ethereum and TRON, and the total reaches $93.2 million once three more chains and five unlisted TRON addresses are added. Ledger has published no figure.

Which coins were stolen decided what could be frozen

About three-quarters of the take, by Bitquery's figures, was USDT on TRON, a dollar token whose issuer can block addresses, so how much victims might recover turned on Tether's freeze. A freeze stops coins moving and returns nothing by itself. Le Coin's check of the USDT contract on TRON shows 37 blocklist entries between 8:09 and 10:10 a.m. ET on Oct. 9, and 20 blocked addresses holding 10,000,001.11 USDT late on Oct. 11. We found no Tether statement. According to Bitquery, the thief swapped 14.9 million USDT into USDD, a TRON stablecoin Tether cannot freeze.

Ether went through Tornado Cash, a mixer that breaks the link between the wallet paying in and the wallet taking out. According to Bitquery, 2,990 ETH was mixed over Oct. 9 and 10, and part of it ended up as 5.35 million USDC in five wallets that Circle, its issuer, can freeze. Le Coin has not verified that trail.

The case against the implant story

Ledger has confirmed one implant in one device. Bitquery says the chain cannot show how each key leaked, though it tested a phishing explanation and rated it unlikely.

What Ledger tells buyers

Ledger's Oct. 11 update says: "For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger." Its support pages say to buy from the Ledger Shop or authorized resellers and to check that the recovery sheets in the box are blank.

A new seed means 24 new words generated by a clean device. Typing the old words into a new device rebuilds the old wallet, which the thief can still empty.

What would change the view

A teardown from Ledger or a named lab, or a device count, would settle the mechanism. Ledger's latest update came at 1:13 p.m. ET on Oct. 11 and set no date for its findings.

Sources

Accessed Oct. 11, 2026, 11:41 to 11:51 p.m. ET. Sources 1 to 4 are Ledger's official X accounts, cited as Ledger statements under the X citation rule.

1. Ledger Support (@Ledger_Support), Oct. 9, 2026, 9:32:12 a.m. ET: https://x.com/Ledger_Support/status/2108551100613714002
2. Ledger (@Ledger), Oct. 9, 2026, 12:54:01 p.m. ET: https://x.com/Ledger/status/2108601890401305087 (same wording, @Ledger_Support, Oct. 10, 2026, 7:55:00 a.m. ET: https://x.com/Ledger_Support/status/2108889031190696353)
3. Ledger Support (@Ledger_Support), Oct. 10, 2026, 1:09:51 p.m. ET: https://x.com/Ledger_Support/status/2108968264055345381
4. Ledger (@Ledger), 72-hour update, Oct. 11, 2026, 1:13:22 p.m. ET: https://x.com/Ledger/status/2109331538072494364
5. Ledger, Find a Ledger Reseller: https://www.ledger.com/reseller
6. Internet Archive, Ledger reseller directory, Sept. 20, 2026, 1:36 p.m. ET: https://web.archive.org/web/20260920173605/https://shop.ledger.com/pages/resellers
7. Ledger Support, Why your Ledger device is secure: https://support.ledger.com/article/Why-Your-Ledger-Device-Is-Secure
8. Ledger Support, How Ledger device generates 24-word Secret Recovery Phrase: https://support.ledger.com/article/4415198323089-zd
9. Ledger Support, Check hardware integrity: https://support.ledger.com/article/4404382029329-zd
10. Ledger Support, Check that your Ledger device has a genuine secure element: https://support.ledger.com/article/4404389367057-zd
11. Ledger Donjon, Threat Model: Genuineness: https://donjon.ledger.com/threat-model/device-genuineness/
12. Bitquery, "The Ledger CryptoBilis hack took $93.2M from 315 wallets," figures verified Oct. 11, 2026. Data source for Fig. 1 bars (section 06, by chain, U.S. dollars at Oct. 9 morning prices). Calculation note: values used as published; bars sum to $93.28M against Bitquery's $93.2M total; EVM wallet rows overlap (73 rows, 58 distinct wallets); "about three-quarters" is 70.2M USDT / $93.2M = 75.3%: https://bitquery.io/investigations/ledger-cryptobilis-hack
13. mempool.space, bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl: https://mempool.space/address/bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl
14. mempool.space, bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9: https://mempool.space/address/bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9
15. TronGrid, TRON USDT contract AddedBlackList events, Oct. 9, 2026, and balances of the 20 blocked addresses, checked by Le Coin: https://api.trongrid.io/v1/contracts/TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t/events?event_name=AddedBlackList
16. Tronscan/TronGrid, USDT inflows to the nine TRON drain addresses, Oct. 9, 2026, checked by Le Coin (Le Coin column of Fig. 1); 7,001,000 USDT transfer: https://tronscan.org/#/transaction/b3b10b86aa2523ab05dae6bfcd485d1377f7d5921b3dfbaa6344fbe3c40a79cd
17. Tibane Labs, "Ledger Nano X: the spy implant": https://www.tibane.net/research/ledger-nano-x-implant
18. Joe Grand, Grand Idea Studio, "Reverse Engineering a Ledger Nano X Hardware Implant," hardwear.io USA 2026: https://grandideastudio.com/portfolio/security/ledger-hardware-implant/
19. Security Alliance (SEAL), SEAL 911: https://securityalliance.org/

Holding the Corner.

Not financial advice.