Skip to content
Ledger Hardware Wallets Compromised by Spyware, $86 Million Stolen

Ledger Hardware Wallets Compromised by Spyware, $86 Million Stolen

First seen 17 Oct 2026, 16:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 17, 2026 at 18:20 UTC
  • •Spyware implants in Ledger wallets allowed unauthorized access to wallet recovery data.
  • •Approximately $86 million in cryptocurrency has been stolen due to this security breach.
  • •Ledger received tampering reports months before the incident but did not issue public warnings.

A significant security breach involving Ledger hardware wallets has been reported, with spyware implants found in devices sold by the Southeast Asian reseller CryptoBilis. These implants allowed attackers to remotely access wallet recovery data, leading to the theft of approximately $86 million in cryptocurrency. The incident has affected multiple users, including a scammer who lost $4.9 million in bitcoin after transferring stolen funds to compromised wallets. Reports indicate that Ledger received warnings about potential tampering months prior but failed to issue public alerts. Following the discovery, Ledger has suspended sales through affected partners and is conducting an extensive investigation. The spyware was reportedly able to transmit sensitive data over mobile networks, raising concerns about the security of hardware wallets. As of now, Ledger has not confirmed any direct link between the reseller's change in ownership and the spyware discovery.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-12-01
Tampering reports received by Ledger
Reports of tampered Ledger devices were submitted to the company, indicating potential security issues.
Cointelegraph
2026-03-04
Security researcher reports tampering
Security researcher Joe Grand reported a compromised Ledger Nano X device to Ledger, which acknowledged the issue.
Cointelegraph
2026-10-09
Mass draining of Ledger wallets
A coordinated attack led to the draining of funds from compromised Ledger wallets, totaling $86 million.
Cryptonews
2026-10-15
Ledger issues statement on attack
Ledger confirmed the attack was a sophisticated operation targeting its distribution channel, not its systems.
Ledger
2026-10-16
Phishing campaigns emerge
Scammers launched phishing campaigns exploiting the panic from the Ledger spyware scandal, targeting users with fake firmware updates.
Cryptonews

More articles in this cluster (11)

Following this threat?

Track CryptoBilis in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (10)

1 / 3

Common questions

What specific Ledger models are affected?
The compromised devices include Ledger Nano X wallets sold through the Southeast Asian reseller CryptoBilis.
How did the spyware operate?
The spyware implants transmitted wallet recovery data over mobile networks, allowing unauthorized access to user wallets.
What actions should Ledger users take now?
Users should cease using affected devices, monitor their accounts for unauthorized transactions, and consider switching to secure alternatives.