Skip to content
Ledger Confirms Tampering in Hardware Wallets Linked to $86M Theft

Ledger Confirms Tampering in Hardware Wallets Linked to $86M Theft

First seen 14 Oct 2026, 21:32 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 14, 2026 at 21:33 UTC
  • •Ledger confirmed tampering in hardware wallets linked to over $86 million in thefts.
  • •Malicious implants were found in devices sold by authorized reseller CryptoBilis.
  • •Sales of Ledger wallets have been suspended across Southeast Asia as investigations continue.

Ledger has confirmed unauthorized tampering in its hardware wallets sold through the reseller CryptoBilis, leading to significant cryptocurrency thefts estimated at over $86 million. The tampered devices, primarily sold in Southeast Asia, contained malicious implants capable of capturing sensitive information, including recovery phrases. Ledger suspended sales in several countries, including Singapore and Malaysia, and is investigating the extent of the compromise. The tampering allows attackers to relay sensitive data to third parties, potentially enabling them to drain victims' wallets. The company has not confirmed the total number of affected users or the exact amount lost. This incident underscores the risks associated with supply chain security in hardware wallets, which are designed to protect users' assets. Ledger's investigation began after reports from customers in Southeast Asia regarding stolen funds.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-08
CVE-2026-85097 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-09
Reports of stolen cryptocurrency emerge
Customers in Southeast Asia reported stolen funds, prompting Ledger to investigate tampered devices.
Esecurityplanet
2026-10-13
Ledger suspends sales in Southeast Asia
Ledger announced the suspension of sales across Southeast Asia due to findings of tampered wallets.
Straitstimes
2026-10-14
Ledger confirms tampering in hardware wallets
Ledger confirmed the presence of unauthorized hardware implants in some wallets sold through CryptoBilis.
Esecurityplanet

More articles in this cluster (2)

Following this threat?

Track CryptoBilis and CVE-2026-85097 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (16)

1 / 3

Common questions

Which regions are affected by the sales suspension?
Sales have been suspended in Singapore, Malaysia, Indonesia, Thailand, the Philippines, Vietnam, and Hong Kong.
What should users do if they purchased a Ledger wallet from CryptoBilis?
Users should stop using the device and monitor their cryptocurrency accounts for any unauthorized transactions.
How does the tampering affect the security of Ledger wallets?
The tampering allows attackers to capture sensitive information, such as recovery phrases, potentially leading to unauthorized access to users' funds.