Ledger says the recent wave of hardware wallet thefts is linked to devices sold through one reseller, CryptoBilis, and not to its own systems or direct sales. If you bought your Ledger from the official store or an authorised reseller and set it up yourself, the reported cases do not point to your device, but it is a good moment to check how you bought it and how your recovery phrase was created.
The story, reported in mid-October 2026, is a useful reminder for beginners in Ireland and across the EU: a hardware wallet is only as trustworthy as the route it took to reach you. Below we explain what happened, what has and has not been confirmed, and the simple checks you can make today.
Key takeaways
- Ledger says all confirmed theft cases involve devices sold through the reseller CryptoBilis; its own systems and direct sales were not affected.
- Ledger confirmed that at least one affected device had an unauthorised hardware implant designed to steal recovery phrases.
- An on-chain investigator estimated suspected thefts above US$86 million, but Ledger has not confirmed this figure.
- If you bought from CryptoBilis in the past 90 days, do not set up an unused device; if you already use one, move funds to a new seed phrase on a device bought directly from Ledger.
- Ledger will never call you, message you, or ask for your 24-word recovery phrase.
What happened
In mid-October 2026, Ledger began investigating after users in Southeast Asia who had bought Ledger devices from a reseller called CryptoBilis reported losing funds. In an update published 72 hours into the investigation, Ledger said that every confirmed case so far involved devices sold through CryptoBilis. The company stated that its own systems and its direct sales channel were not affected.
Ledger also confirmed that one of the affected devices contained an unauthorised hardware implant. In plain terms, someone had physically tampered with the device so that it could capture the owner’s recovery phrase, the list of words that controls the wallet. Anyone holding that phrase can move the funds from any compatible wallet, which is why stealing it is the goal of almost every wallet attack.
CryptoBilis has stopped selling hardware wallets. On-chain investigator Specter estimated that suspected thefts linked to the incident exceed US$86 million across the Ethereum, Tron and Bitcoin networks. Ledger has not confirmed that number, so treat it as an estimate rather than an official total. Tether, the company behind the USDT stablecoin, froze 10 million USDT connected to the case.
A claim circulating on X said that tampered devices had also been found in Europe. At the time of writing this claim is unverified, and Ledger’s confirmed cases relate to CryptoBilis buyers. We will not treat it as fact, but it is a good reason for European buyers to double-check where their device came from.
Why a tampered device is so dangerous
A hardware wallet, sometimes called a cold wallet, keeps your private keys offline. That design protects you well against malware on your computer and against many online scams. Its weak point is the supply chain: if a device is altered before it reaches you, the protection can be undermined before you ever plug it in. If you are new to the difference between device types, our guide to hot wallets versus cold wallets explains the basics.
Attacks of this kind usually rely on one of two tricks. The first is a physical implant, as Ledger confirmed in this case. The second is simpler and older: the package includes a card with a recovery phrase already printed on it, and the buyer is told to use it. Whoever printed that phrase already has access to the wallet. A genuine device always generates a brand-new phrase on its own screen during setup, and nobody else should ever see it.
How to buy a hardware wallet safely
Whichever brand you choose, the same rules apply. They take a few minutes and remove most of the supply-chain risk.
- Buy from the official store or an authorised reseller. Check the manufacturer’s own website for its list of authorised sellers. Avoid marketplace listings, second-hand devices and unusually cheap offers.
- Inspect the packaging. Look for signs that the box has been opened, resealed or damaged. If anything looks wrong, do not set the device up; contact the manufacturer first.
- Never use a pre-filled recovery sheet. If a phrase is already written or printed on anything in the box, the device is compromised. Do not use it.
- Let the device generate a new phrase. During setup, the words must appear on the device’s own screen, and you write them down yourself.
- Run the genuine check in the official app. Use only the manufacturer’s official app, downloaded from its real website, to confirm the device is authentic.
For a step-by-step walkthrough, see our hardware wallet setup guide.
What to do if you are worried
Start by working out where your device came from. Find the order confirmation or receipt. If you bought directly from Ledger or from a reseller listed as authorised, the confirmed cases do not involve your purchase.
If you bought from CryptoBilis within the past 90 days and have not set up the device yet, Ledger’s advice is clear: do not set it up. If you have already set up such a device and put funds on it, Ledger recommends moving those funds to a new seed phrase created on a device bought directly from Ledger. The key point is the new phrase: transferring your old phrase to a new device does not help, because the old phrase may already be known to the attacker.
If you are unsure about your device for any other reason, the same logic applies. A fresh device from a trusted source plus a fresh recovery phrase is the clean way to start again. Our seed phrase security guide, linked below, covers how to store the new words safely offline.
Finally, expect scammers to use the news. Fake “Ledger support” emails, calls and direct messages often appear after a security story, offering to “secure” your wallet. Ledger has said it will never call you, send you a DM or ask for your 24-word recovery phrase. Anyone who asks for it is trying to steal from you. Our guide to crypto phishing shows the common patterns.
Sources
Frequently asked questions
Is my Ledger safe if I bought it from the official store?
According to Ledger, all confirmed cases involve devices sold through CryptoBilis, and its own systems and direct sales were not affected. You should still confirm that your recovery phrase was generated by the device itself and that you have never shared it.
Was Ledger itself hacked?
Ledger says no. Its update stated that its own systems were not affected and that the confirmed cases are linked to devices sold by one reseller, at least one of which had an unauthorised hardware implant.
Have tampered devices been found in Europe?
A claim on X said so, but it is unverified. Ledger’s confirmed cases relate to CryptoBilis buyers in Southeast Asia. European buyers should simply check that they bought from the official store or an authorised reseller.
Is US$86 million the official loss figure?
No. That estimate comes from on-chain investigator Specter. Ledger has not confirmed it, so the true amount may differ.
Someone from Ledger support contacted me. What should I do?
Do not respond and never share your recovery phrase. Ledger says it will never call you, DM you or ask for your 24 words. Treat any such contact as a scam attempt.
Next step: read our hardware wallet setup guide before you unbox a new device, and review how to protect your seed phrase. This article is general information, not financial or security advice for your specific situation.
