Full Breakdown
Ledger faces $90 million-plus crypto theft after supply-chain tampering; launches Atom security phone
By Drooid · · How we work
Core Incident: Supply-chain attack on Ledger wallets
On Oct 9 2026, Ledger users reported drained wallets. Investigations traced the theft to devices sold by Southeast Asian reseller CryptoBilis. Ledger confirmed at least one unit contained an unauthorized hardware implant that captured the 24-word recovery phrase during setup and transmitted it via an LTE eSIM. On-chain analysts estimate losses between US $86 million and US $93 million.
Timeline
- Oct 9 2026 – Users report drained wallets; losses exceed US $90 million.
- Oct 10 2026 – CoinGecko CEO Bobby Ong and Hata CEO David Low warn that reseller channels increase supply-chain risk.
- Oct 11 2026 – Ledger’s 72-hour update links confirmed cases to CryptoBilis devices.
- Oct 13 2026 – Ledger asks Southeast Asian and Hong Kong resellers to suspend sales.
- Oct 15 2026 – Ledger announces the Ledger Atom, a smartphone-like security device slated for release next summer.
Data & Statistics
- Theft estimates: $86 million (Specter), $90 million (Galaxy Digital), $93 million (on-chain researchers).
- Affected wallets number in the hundreds, with over 300 compromised devices cited.
- Ledger has sold over 8 million hardware wallets.
- The Atom device is priced at US $899 and targets a market of roughly 200 million security phones sold annually.
Official Statements & Responses
Ledger CEO Pascal Gauthier said the breach was limited to the reseller channel and that internal systems and direct-sales devices remain uncompromised. He called physical supply-chain tampering an industry-wide risk and announced a review of reseller controls and anti-tamper safeguards. CTO Charles Guillemet instructed users who suspect tampering to follow Ledger’s guidance for safely opening devices and to forward suspicious units for examination. Ledger urged affected customers to move assets to a new device with a freshly generated recovery phrase and to contact official support channels.
Criticism & Opposition
- David Low, co-founder and CEO of Malaysian exchange Hata, called for hardware-wallet sellers to be regulated under Malaysia’s Digital Asset Custody law and urged Ledger to clarify monitoring of its authorised reseller network.
Conflicting Reports & Gaps
Loss estimates vary from $86 million to $93 million, and Ledger has not confirmed the total number of users affected. The exact point in the distribution chain where the implant was added remains undisclosed, and no public evidence links the tampering to devices sold outside Southeast Asia, though isolated reports mention a German retailer.
Verbatim Quotes
- “Physical supply chain tampering is a risk for the whole industry,” — CEO Pascal Gauthier
- “We understand this is concerning, and will continue to provide updates from the Ledger Donjon [Ledger’s security research team] as the investigation progresses. Stay vigilant,” — Ledger security team
What’s Next
Ledger’s Atom will launch next summer, combining an open-source Android environment with a dedicated Ledger OS on a secure chip. Ledger continues to work with authorities and its security research team, Ledger Donjon, to investigate the breach and develop additional anti-tamper measures.