The Hacker News reported October 12, 2026 that hardware-wallet maker Ledger paused sales through Southeast Asian reseller CryptoBilis after customers reported drained funds. Ledger Support said on October 10 that one impacted user’s device contained an unauthorized hardware implant. An October 11 follow-up said the number of affected devices looks limited, and that all confirmed cases tied to the October 9 draining incident involve devices sold through CryptoBilis.
Ledger says its own systems and direct sales channels were not compromised. On-chain researcher Specter has estimated losses above $86 million (other tallies run toward $93 million across hundreds of wallets). Ledger has not confirmed a loss figure. Treat researcher totals as estimates.
If you bought a Ledger from CryptoBilis in the last 90 days and have not set it up, do not initialize it. If you already set it up, move assets to a new Ledger signer with a new recovery phrase, bought from shop.ledger.com or another channel Ledger still authorizes. Type support.ledger.com yourself. Ledger and CryptoBilis will never ask for your 24-word phrase or PIN.
Snapshot
| Field | Detail |
|---|---|
| Drain reports | October 9, 2026 (Ledger’s confirmed-case window) |
| Implant confirmation | Ledger Support — October 10, 2026 |
| Scope update | Ledger — October 11, 2026 (limited devices; CryptoBilis-sold only) |
| Platform compromise | Not reported — Ledger says infrastructure and direct sales are unaffected |
| CourtListener | 0 RECAP dockets on CryptoBilis / this implant (searched Oct 12, 2026) |
| Official hosts | Type ledger.com · shop.ledger.com · support.ledger.com |
Who is at risk
Buyers who purchased a Ledger through CryptoBilis (Indonesia, Malaysia, and the Philippines) in roughly the last 90 days are the group Ledger is warning. Everyone else still faces the usual recovery-scam wave: fake support chats, lookalike domains, and “we can recover your funds” offers that ask for the seed.
A hardware implant is physical supply-chain tampering, not a spoofed Ledger login. MFA on an exchange account does not restore a seed that already left the device.
What to watch for
- A device that arrived with a recovery phrase already printed or written on a card
- Anyone — including “Ledger support” or “CryptoBilis recovery” — asking for the 24 words or PIN
- Offers to recover lost funds after this headline (almost always a second scam)
- Purchases from unauthorized resellers or restocked returns
- A companion-app “genuine check” used as proof the plastic was never opened — that check talks to Ledger’s servers; it is not a full physical teardown
CryptoBilis told customers: generate the phrase on the device, write it down yourself, and treat the wallet as unsafe if anyone else has seen the words.
What to do
- If the CryptoBilis unit is still in the box, do not set it up. Contact official Ledger Support.
- If it is already in use, move assets to a new device and a new seed from Ledger’s own shop or a still-authorized seller. Do not restock or resell the old unit as new.
- Never type the recovery phrase into a website, chat, or “recovery” app.
- Lock remaining exchange accounts with a YubiKey (and an authenticator app). MFA will not undo a stolen seed, but it stops a follow-on password theft.
- If funds moved without you, keep the device and records, file a local police report, and submit a complaint at IC3.
MFA: YubiKey and Google Authenticator
Ledger Wallet (formerly Ledger Live) is a local app. It unlocks with the device PIN, not a cloud login with Google Authenticator. Optional Ledger Recover restores access with identity verification (government ID, selfie / live checks, a device-bound one-time code) — not a self-serve YubiKey or open TOTP enrollment. Ledger’s Recover write-up describes IDV with Onfido / Coincover / Tessi, not authenticator-app 2FA.
The Security Key app on a Ledger can act as a FIDO key for other websites. That does not grade Ledger Recover as Strong. If a seed is exposed, Ledger’s own docs note that some Security Key credentials can be recreated on a new device restored with the same 24 words (resident keys excepted). Treat a CryptoBilis-era seed as burned, including any FIDO logins you registered with that phrase.
Grades match our MFA directory.
| Grade | Meaning |
|---|---|
| Fail | No self-serve YubiKey / open TOTP — or SMS / email OTP remains |
| Pass | Self-serve Google Authenticator-style open TOTP |
| Strong | FIDO2 / YubiKey-class security key for sign-in |
| Platform | Grade | YubiKey | Authenticator |
|---|---|---|---|
| Ledger Recover | Fail | No | No |
| CryptoBilis shop | Fail | No | No |
CryptoBilis publishes no customer-account YubiKey or Google Authenticator path. MFA on Recover or the reseller shop would not have stopped a hardware implant.
Recommended MFA tools
| Product | Best for | Get it |
|---|---|---|
| YubiKey 5C NFC | USB-C laptops + NFC phones | Amazon |
| YubiKey 5 NFC | USB-A desktops + NFC phones | Amazon |
| Proton Pass | Passkeys + authenticator-style TOTP | Proton Pass |
We may earn a commission if you buy a YubiKey or sign up for Proton Pass through the links above.
Independent cybersecurity audits
We audited reporting, vendor, and reseller hosts on October 12, 2026. 100% is the ideal — none reach it. These scores are public email / transport / website posture. They do not mean Ledger.com was hacked, and they do not score the plastic implant.
| Organization | Domain | Overall | vs 100% |
|---|---|---|---|
| FBI IC3 | ic3.gov | 87% | −13 |
| FBI | fbi.gov | 82% | −18 |
| Ledger | ledger.com | 61% | −39 |
| CryptoBilis | cryptobilis.com | 52% | −48 |
| Domain | Identity | Transport | Website |
|---|---|---|---|
| ic3.gov | 90% | 45% | 97% |
| fbi.gov | 75% | 45% | 100% |
| ledger.com | 65% | 80% | 37% |
| cryptobilis.com | 50% | 15% | 37% |
Audit links: ic3.gov · fbi.gov · ledger.com · cryptobilis.com
cryptobilis.com Transport 15% and Identity 50% means spoofed “CryptoBilis / Ledger recovery” mail is easier to deliver than the 52% overall suggests. ledger.com Website 37% is the weak slice on an otherwise middling vendor score.
Website stack note
Passive website-tech probes on October 12, 2026:
| Domain | Stack signal |
|---|---|
| ledger.com | Probe reported WordPress 3.7.1 (treat as a generator fingerprint, not a confirmed 2013 CMS); Sectigo TLS expires 2027-01-09 |
| shop.ledger.com | Next.js (X-Powered-By exposed); Let’s Encrypt TLS expires 2026-11-21 (40d) |
| cryptobilis.com | WordPress, version hidden; Google Trust Services TLS expires 2027-01-09 |
| ic3.gov | Undetected CMS; DigiCert TLS expires 2027-01-05 |
Point-in-time only. A marketing homepage is not a hardware-implant forensic finding.
Blacklist and lookalike domains
Email blacklist checks (public DoH, October 12, 2026): ic3.gov was clear. ledger.com was clear on mail/domain lists; a Cloudflare web IP showed an informational SPFBL note — not a mail-reputation hit. cryptobilis.com was listed: mail.cryptobilis.com (103.6.198.76) on SPFBL. Do not read that listing as proof of the implant; do treat reseller mail as easy to spoof while Transport sits at 15%.
DNS lookalike scans (BEC profile, registered signals only):
| Brand scanned | To review | Likely owned | BEC staging |
|---|---|---|---|
| ledger.com | 26 | 3 | 2 |
| cryptobilis.com | 0 | 0 | 0 |
High-interest registered names (investigate; not proof this incident used them):
| Lookalike | Technique | Note |
|---|---|---|
| ledger.online | tld-swap | BEC staging (NS + MX) |
| leedger.com | insertion | BEC staging (NS + MX) |
| leadger.com | insertion | Live NS + A + MX |
| eledger.com | insertion | Live NS + A + MX |
ledger.co, ledger.org, and ledger.security redirect to the real site (likely owned). Type ledger.com and support.ledger.com, not a support-affix or .online swap. Continuous monitoring: Cybersquat Domain Monitoring.
CourtListener
Federal RECAP search on October 12, 2026 returned no docket naming CryptoBilis or this implant. Ledger SAS does have older U.S. civil cases, including Kim v. Ledger SAS (1:26-cv-07307, S.D.N.Y., filed August 27, 2026, contract — not this incident). Do not treat those filings as implant litigation.
Related coverage
- MFA support directory — YubiKey, TOTP, passkeys
- Financial services AG breaches 2026
- Montrose Leighton’s tap-to-pay wallet fraud
- FBI IC3 cyber alerts
Run a free audit at audit.emailmenow.com or contact EmailMeNow for DMARC / MTA-STS and phishing response aimed at the 100% ideal.
Sources: The Hacker News — Ledger / CryptoBilis implant (Oct 12, 2026) · Ledger Support on X (Oct 10, 2026) · CoinDesk (Oct 12, 2026) · Cointelegraph (Oct 11, 2026) · CryptoBilis · Ledger Recover and Security Key help · IC3. Independent EmailMeNow audits, website-tech, blacklist, cybersquat, and CourtListener searches October 12, 2026. Domain scores: audit.emailmenow.com only.