Ledger said every confirmed case in last week's wallet-draining incident involves devices sold through Southeast Asian reseller CryptoBilis, while its own systems and direct sales channels remain unaffected. The company described the number of affected devices as “limited,” said it is working with authorities, and noted that CryptoBilis has ceased all hardware wallet sales. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, and YFarmX sent Ledger a list of more than 450 drained wallets, though Ledger has not confirmed these figures or the cause. Separately, a user on X claimed to have found tampered Ledger devices in Europe and called for a recall, a claim that has not been independently verified. Ledger has told authorized resellers never to restock returned products and advised CryptoBilis buyers to move their funds to a new seed phrase on a device bought from Ledger.
Summary written by Upside AI from the original article. Read the source for full details.
Read the original on Decrypt ↗
Related news
- Ledger Asks Resellers in Seven Asian Markets to Pull Devices After Suspected $86M Drain
Ledger has asked resellers and distributors in six Southeast Asian countries and Hong Kong to suspend sales and pull its hardware wallets from shelves while it investigates devices fitted with a hidden implant. The implant reads the 24-word recovery phrase during setup and sends it out over LTE, so anyone holding that phrase can move the wallet's funds. All confirmed losses involve devices sold through CryptoBilis, a regional reseller, and Ledger has not verified any drain linked to devices bought elsewhere, nor sees any indication its own systems were compromised. Onchain investigator Specter has traced more than $86 million in suspected thefts, a figure Ledger has not verified. MediaMarkt Saturn stopped selling Ledger devices after a German customer reported an implant, though no funds were lost, and rival Trezor will end reseller authorizations on January 1, 2027 as a precaution.
- Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain
Ledger said its Donjon security team found an unauthorized hardware implant inside signers sold by Southeast Asian reseller CryptoBilis, which reads the 24-word recovery phrase from the screen during setup and sends it over LTE using a provisioned eSIM. Ledger confirmed the implant on one affected user's device on October 10th, and said all confirmed losses so far involve devices bought from CryptoBilis, which has stopped selling Ledger devices. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, but Ledger has not verified the number of affected users or total losses. The company told buyers who have not set up their device not to do so and to contact Ledger Support, while those who have should move assets to a new device with a new recovery phrase and report to police. Ledger is also reviewing reports of implants in other devices and locations.
- Ledger claims CryptoBilis cases are limited as up to $93M is traced, $10M frozen
Ledger said every confirmed case involves devices sold by the authorized reseller CryptoBilis, though critics argue the hardware-wallet maker must answer for that sales channel. Blockchain analytics firms estimate attackers stole between $93.2 million (Bitquery) and $94.5 million (YFarmX) from wallets linked to these devices, though Ledger has not confirmed a total. Ledger confirmed an unauthorized hardware implant in at least one affected device, and Tether froze $10 million in USDT tied to the theft. Bitquery said about $81 million could still be traced onchain as of Oct. 11, with some funds moved through Tornado Cash and Zcash. Ledger advised CryptoBilis customers not to set up unused devices and, if they already use one, to move assets to a new device with a newly generated recovery phrase.
- Ledger says 'spy' chip inside CryptoBilis Ledger devices transmitted wallet keys over mobile network
Ledger said a covert chip hidden in some hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases from the device screen and sent them to attackers over an LTE mobile network using an eSIM. The implant did not modify the secure element, the operating system, or any transactions and signatures, so Ledger describes it as a physical supply-chain attack rather than a breach of its software or systems. Ledger has confirmed one affected signer with an unauthorized implant and says all confirmed losses in the Oct. 9 incident involved CryptoBilis-sold devices, while it is still examining reports in other devices and locations. Onchain researchers estimated losses of up to $93.2 million across more than 300 wallets, and Tether froze $10 million of USDT tied to the theft. CryptoBilis has stopped selling Ledger signers, and customers who already used one should move assets to a device with a newly generated recovery phrase.
- Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
Ledger said LTE-enabled implants in wallets sold by CryptoBilis captured the 24-word recovery phrases shown on device screens during setup and sent them over cellular networks via an eSIM, without compromising the secure chips or altering transactions. The issue came to light after crypto losses involving devices sold through the reseller, which is listed as authorized in Indonesia, Malaysia and the Philippines. Blockchain investigator Specter estimated losses could exceed $86 million, while Yfarmx put them at $103 million, though Ledger has not confirmed a total. CryptoBilis halted sales of all hardware wallet brands in those three countries, Trezor said it received no reports of tampered devices but removed the reseller, and OneKey terminated its authorization and offered free replacements for devices bought from CryptoBilis in 2026. Ledger is also examining reports beyond the reseller, including European cases involving devices bought from MediaMarkt, but has not confirmed a link.
- Ledger says unauthorized implant found in at least one device sold by CryptoBilis
Related markets
Latest news
- One of this year's most important relationships in global financial markets is falling apart
One of the most important relationships in global markets has started to unravel over the past couple of weeks. Investors are scrambling to work out what it could mean for the economy and their portfolios.
- 2 High-Flying Dividend Stocks to Buy and Hold for a Decade
The article argues healthcare is rebounding in 2026, with Merck (MRK) shares up 39% and AbbVie (ABBV) up 24% year to date, versus about 12% for the S&P 500. Merck's second-quarter revenue rose 5% to $16.6 billion, beating estimates, with Keytruda sales of $8.4 billion, though Keytruda may lose patent exclusivity by 2028. AbbVie's second-quarter revenue grew 10.2% to nearly $17 billion and adjusted EPS rose 22.9% to $3.65, driven by Skyrizi and Rinvoq sales growing about 24%. AbbVie is on a streak of 54 consecutive annual dividend increases, including its time as part of Abbott Laboratories, qualifying it as a Dividend King. The author concludes both are attractive long-term holdings based on financial results, pipelines, and dividends.
- Nvidia (NVDA) Stock Price Lags Massive Earnings Growth—A Compelling Value Opportunity
Munro Partners' Munro Global Growth Fund posted a -12.6% net return in Q3 2026, trailing the MAET.ASX return of -13.8%, with long holdings the main detractors. The fund's letter named NVIDIA (NASDAQ:NVDA) its largest contributor, citing strong earnings growth and guidance for at least 70% revenue growth next fiscal year, versus consensus of 45%. Nvidia reported quarterly revenue of USD96.2bn in August, up 106% year on year, and management said growth would have been closer to 100% without supply constraints. As of October 12, 2026, NVDA closed at $214.13, down 4.23% over the past month and up 19.23% over the past year, with a $5.16 trillion market cap and a 52-week range of $164.27 to $243.37. The fund says demand for semiconductors and AI remains strong, creating a constructive setup as capex and political fears are now priced in.
- Better Artificial Intelligence Stock for 2026: C3.ai vs. SentinelOne
The article compares C3.ai, which sells enterprise AI applications, with SentinelOne, which provides AI-powered autonomous cybersecurity. In fiscal 2026 (ended April 30), C3.ai's revenue was nearly $250.3 million, down 35.7%, with a net loss of $470.4 million and negative free cash flow of $190.7 million. SentinelOne's fiscal 2026 (ended January 31) revenue reached $1.0 billion, up 21.9%, with a net loss of $450.7 million and free cash flow of about $75.9 million, though stock-based compensation equaled roughly 388.4% of operating cash flow. The article cites C3.ai's restructuring plan from February 2026 and long government sales cycles as risks, and SentinelOne's competition from larger vendors and reliance on Amazon hosting. It says SentinelOne trades at a lower valuation relative to sales, while C3.ai has no future earnings estimates.
- Salazar Resources to Begin Drilling the Yumi Gold-Silver Veins at Tarqui, with Porphyry Drilling Planned at Monja, Ecuador
Salazar Resources closed a $3,500,000 non-brokered private placement announced on October 8, 2026, and outlined its exploration plan. Phase 1 is about 1,500 metres of drilling in five holes at the Yumi gold-silver veins on its 100%-owned Tarqui project, with drilling expected to begin in late October 2026, and the veins have not previously been drilled. Selective rock-chip samples returned 105 g/t Au and 1,038 g/t Ag, and historical BHP holes intersected porphyry-style mineralization nearby, which the company interprets as lying on the periphery of a porphyry center not yet located. Phase 2 contemplates up to about 3,500 metres of drilling in four holes at the 100%-owned Monja copper-gold porphyry target from the first quarter of 2027, subject to surface access and permits. A soil survey of about 895 samples is also planned at Quimi, part of the Tarqui-Quimi project.
- Musk: AI’s Hard Part Is “Scaling Power”: 3 Stocks Uniquely Suited to Win This New Bottleneck Trade
Microsoft said it will scale its Maia chips to multi-gigawatt deployments starting next calendar year, and Elon Musk said scaling power is the hard part of AI. The article argues power is an input that chip and app companies cannot copy quickly, which favors Vistra (VST), Constellation Energy (CEG) and GE Vernova (GEV). Vistra has lost nearly a fifth of its value over the past year even though its adjusted EBITDA rose to $5.91 billion, while Constellation's normalized EPS is expected to reach $13.29 in fiscal 2027. GE Vernova's revenue is expected to reach $60.7 billion by fiscal 2028, and Jefferies has a $298 price target on Vistra. The article warns that all three stocks could move with the mood around AI, regardless of their results.
Get the briefing on Telegram or Zalo
Join the Upside Telegram channel or Zalo group for the Vietnam stocks and gold briefing at 8:00 and 19:00 (Vietnam time) on trading days, plus a weekly wrap on Saturday morning.