Ledger Reseller Implant Case Expands to an Estimated $102 Million Across Six Chains

Frank Joaquin

Date: October 18, 2026

The estimated loss connected to tampered Ledger devices sold through Southeast Asian reseller CryptoBilis has increased to $102 million across 335 wallets, based on an updated Bitquery reconstruction verified through October 16. The estimate covers Bitcoin, Ethereum, Tron, Solana, BNB Chain and Polygon. Bitquery

Ledger’s official incident response, last updated October 15, says confirmed cases involve devices sold through CryptoBilis. Ledger says its own systems and direct sales channels were not compromised and describes the incident as an attack on the distribution channel after devices left its control. CryptoBilis paused sales and shipments while the investigation continued.

The physical implant reportedly captured recovery phrases during device setup. Anyone holding those words can reconstruct the wallet elsewhere and transfer assets without the original device. Ledger has told users not to enter or restore a recovery phrase on a device bought from CryptoBilis. Affected users who already initialized one should move assets to wallets generated from new seed phrases on trusted hardware.

Loss estimates remain analytical rather than a company-confirmed total. The Financial Times reported approximately $90 million stolen, while Ledger has not published its own aggregate. Bitquery’s higher figure reflects additional addresses and chains found through transaction tracing. Its attribution and service labels are investigative findings, not judicial conclusions.

Bitquery says Tether froze $10 million in USDT and that thousands of ether moved through Tornado Cash, with additional value routed through Zcash and cross-chain services. The public ledger can confirm transfers and freezes on transparent chains. It cannot by itself establish who installed the hardware, where the devices were altered, or who ultimately controls privacy-shielded funds.

TOKEN RECON ASSESSMENT

The operational lesson is broader than one wallet brand. Authorized-reseller status did not provide end-to-end provenance, and cryptographic firmware checks cannot detect every malicious component added after manufacture. The loss total may continue to change, but the response threshold is already clear: any CryptoBilis-sourced device should be treated as compromised until Ledger says otherwise. The investigation now needs serial-number scope, chain-of-custody records and independently reproducible victim-address attribution.