Story perspectives

Ledger SAS Reviews Sales Policies After $90M CryptoBilis Theft

By Drooid · Oct 14, 2026, 2:42 PM UTC · How we work

Summary

Story summary

Ledger SAS is reviewing sales policies after spyware implants in CryptoBilis wallets caused $90 million losses.
The implant reads the 24-word recovery phrase on screen and transmits it via LTE eSIM.
Analysts estimate $102 million moved from 324 wallets through Tornado Cash and Zcash after the thefts.
CryptoBilis halted hardware-wallet sales and closed stores in Malaysia, Indonesia and the Philippines.
OneKey terminated CryptoBilis’s authorization and is reviewing all distributors.

History

Historical Context

In February 2014, the Mt. Gox exchange collapsed after a $450 million Bitcoin theft, triggering worldwide regulatory scrutiny and investor panic across financial markets. Japanese authorities, led by the Financial Services Agency, seized the platform’s assets, while CEO Mark Karpeles received a two-year prison term and a $1 billion civil fine. The Mt. Gox collapse mirrors today’s CryptoBilis hardware-wallet breach, where sophisticated spyware harvested 24-word recovery phrases and siphoned $102 million through Tornado Cash and Zcash mixers. Consequently, regulators worldwide now mandate stricter custody standards, compelling firms like Ledger SAS to overhaul sales policies, audit distributors, and implement multi-factor authentication for wallet devices.

1 of 2

Story summary

Ledger SAS is reviewing sales policies after spyware implants in CryptoBilis wallets caused $90 million losses.
The implant reads the 24-word recovery phrase on screen and transmits it via LTE eSIM.
Analysts estimate $102 million moved from 324 wallets through Tornado Cash and Zcash after the thefts.
CryptoBilis halted hardware-wallet sales and closed stores in Malaysia, Indonesia and the Philippines.
OneKey terminated CryptoBilis’s authorization and is reviewing all distributors.

1 / 2