USD
Ledger Finds CryptoBilis Device Implant as Tether Freezes $10M
OneKey revokes reseller authorization as onchain estimates reach $94.5 million
TL;DR
- Ledger confirmed an unauthorized hardware implant in at least one affected device, with all confirmed cases tied to wallets sold by Southeast Asian reseller CryptoBilis.
- Onchain estimates put losses as high as $94.5 million, while Tether froze $10 million in USDT linked to the theft.
- OneKey revoked CryptoBilis as a dealer, began reviewing its reseller network and offered replacements to eligible CryptoBilis customers.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Ledger has confirmed that at least one device linked to the CryptoBilis wallet draining incident contained an unauthorized hardware implant. Ledger said all confirmed cases tied to the Oct. 9, 2026 incident involve devices sold through CryptoBilis, while its internal systems and direct sales channels remain unaffected. Separately, blockchain analysis linked tens of millions of dollars in losses to affected wallets, and Tether froze USDT connected to the theft.
Ledger Support said on Oct. 10, “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” Ledger said it was contacting affected users, while CryptoBilis suspended sales of Ledger hardware pending the investigation. A follow-up update on Oct. 11 said the number of affected devices appeared limited. CryptoBilis operates in Indonesia, Malaysia and the Philippines.
Earlier third-party estimates placed losses between $86 million and $93 million from more than 300 wallets. More detailed analyses from Bitquery and YFarmX produced different totals based on public blockchain data rather than a loss figure confirmed by Ledger.
Bitquery said the stolen assets were mostly USDT and TRON tokens. It also said about $81 million remained traceable onchain as of Oct. 11, although some assets had moved through Tornado Cash and Zcash. Bitquery confirmed the Tether freeze.
Ledger tells CryptoBilis customers to move funds
Ledger advised customers who bought devices through CryptoBilis not to initialize unused wallets. For devices already set up, its guidance was: “Do not initialize unused devices. If already set up, move to a new seed on a device from Ledger.” Ledger also urged affected users to contact official Ledger Support and local law enforcement.
The company warned customers that it will never call, send a direct message or request their 24-word recovery phrase. Ledger also said it was cooperating with relevant authorities, told distributors to source products only through authorized channels and prohibited restocking returned products.
Ledger said it is reviewing authorized-reseller controls, strengthening hardware protections and seeking improvements in chain-of-custody practices. “Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes,” Ledger said.
Binance co-founder Changpeng Zhao alleged on X that the attackers “apparently bought the reseller and made them sign a non-disclosure agreement to keep their mouth shut.” The allegation has not been independently verified.
Ledger’s attempt to distinguish the event from a compromise of its own systems also drew criticism because CryptoBilis had been listed as an authorized reseller. X user MyCryptoParadise wrote, “It’s not a CryptoBilis incident, it’s a Ledger incident,” adding, “At least take ownership of this mess.”
The incident differs from an April phishing campaign involving a fake Ledger Live application on Apple’s App Store that drained at least $9.5 million after victims entered recovery phrases. The CryptoBilis case instead appears to involve attackers obtaining the keys needed to empty wallets directly.
OneKey revokes CryptoBilis and reviews dealer network
OneKey founder and CEO Yishi Wang said the hardware-wallet maker had ended its relationship with CryptoBilis. “We have terminated CryptoBilis’s authorization; it is no longer an authorized OneKey dealer,” Wang wrote. CryptoBilis also lists Trezor, Tangem, SafePal, imKey and other hardware wallets among products it sells. Ledger wallets are the only devices described as having reported thefts tied to the current incident.
Wang said OneKey’s “dealer network will shrink significantly.” OneKey stopped adding new dealers effective with its Oct. 12 statement and said existing dealers would undergo another review. Dealers with “unverifiable operating entities or unclear ultimate beneficiaries” will have their authorization revoked, with OneKey planning to publish its authorized-dealer list on its website.
Customers who bought OneKey devices from CryptoBilis between March 1, 2026 and Oct. 12 are eligible for a free replacement, including customers who already activated or used their devices. Wang said the cutoff was chosen because a CryptoBilis original co-founder had publicly said the reseller completed an operational-management handover in March after being acquired earlier in the year.
CryptoBilis’s former co-founders said on LinkedIn that the company was handed to new owners that month. An individual identified as Jiaming, a Chinese national, was named as the new owner, but no confirmed link between the ownership change and the security incident has been established.
OneKey’s only publicly reported hardware flaw dates to 2023, when security firm Unciphered extracted a seed from a device during a laboratory attack. OneKey patched the issue, paid a bounty and said no users were affected.
Hardware-wallet security issues have extended beyond the current case. Following the 2022 collapse of FTX, more investors shifted toward self-custody hardware. A July 2026 flaw in Coldcard seed-generation firmware was linked by onchain researchers to an estimated $100 million to $130 million in bitcoin losses. Galaxy Research separately put Coldcard losses above $115 million. Six hardware-wallet brands have disclosed security problems during 2026, with the Ledger case described as the second in which funds were lost.
This article has been refined and enhanced by ChatGPT.
