LEDGER CONFIRMS AN UNAUTHORIZED HARDWARE IMPLANT IN ONE DRAINED USER’S DEVICE — CRYPTOBILIS STOPS ALL HARDWARE WALLET SALES — LEDGER’S FIX IS A NEW SEED ON A NEW LEDGER

Ledger said on October 10, 2026, that one impacted user’s device “contained an unauthorized hardware implant.” The post went up on its Ledger_Support account at 1:09 PM ET. That is one device. Ledger did not say what the implant does, how it got in, or how many other devices carry one.

The drained wallets trace back to CryptoBilis, a reseller in Southeast Asia. Ledger says CryptoBilis has stopped selling all of its hardware wallet stock until the investigation ends. Ledger’s advice to those buyers: if you have not set the device up, don’t. If you have, “consider moving assets to a new Ledger signer (with a new seed).” Ledger also says it has “no indication” its own systems or services were compromised.

That is the hard part of a seed you did not watch get made. A device opened and changed before it reaches you can learn your words as you write them down. A new seed is the right move. But the fix Ledger offers is another Ledger, and the buyer still has to trust the box it came in. Ledger says it is working on “further, enhanced anti-tampering solutions.” It has not said what they are.

The losses are still not settled. Bitcoin.com reports $92.9 million across 311 addresses from Bitquery and $93.4 million across 471 from the analyst Yfarmx. TokenPost puts it at more than $72 million up to $93.4 million. Ledger has confirmed none of these. On chain, the two big bitcoin addresses tied to the drain still held 92.51 and 111.28 bitcoin at block 970,838 on October 10, untouched. At the time of this writing, bitcoin was $82,983.