--- title: "Ledger and CryptoBilis: what you need to know" description: Ledger wallets sold by reseller CryptoBilis turned out to be tampered with. Read what happened, who is at risk and what you can do now. image: https://start.btcdirect.eu/hubfs/Screenshot%202026-10-12%20at%2016.07.19.png --- **[![](https://start.btcdirect.eu/hs-fs/hubfs/BTC_Direct-Logo-RGB.png?width=1406&height=360&name=BTC_Direct-Logo-RGB.png)](http://btcdirect.eu)** - [Private Trading Desk](https://start.btcdirect.eu/nl/private-trading) - [Blog overview](https://start.btcdirect.eu/nl/blog) Make an appointment ![English](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/flags/united-kindom.svg) English en Language - [![Deutsch](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/flags/german.svg) Deutsch](https://start.btcdirect.eu/de/blog) - [![English](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/flags/united-kindom.svg) English](https://start.btcdirect.eu/blog) - [![Español](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/flags/spain.svg) Español](https://start.btcdirect.eu/es/blog) - [![Français](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/flags/france.svg) Français](https://start.btcdirect.eu/fr/blog) - [![Nederlands](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/flags/netherlands.svg) Nederlands](https://start.btcdirect.eu/nl/blog) ![Close Popup](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/cross.svg) - Private Trading Desk - 13 Oct 2026 On this page: # Ledger and CryptoBilis: what you need to know On 9 October, reports emerged of stolen crypto from users who had bought their Ledger hardware wallet from **CryptoBilis**, an official reseller based in Malaysia. Ledger has since confirmed physical tampering with at least one affected device. The investigation into the cause and scale is still ongoing. ## **1. What happened?** - **9 October:** Ledger opens an investigation into the reported thefts and asks CryptoBilis to stop selling and shipping Ledger devices. - **10 October:** Ledger confirms that an unauthorised hardware implant was found in the device of an affected user. - **11 October:** Ledger reports that all cases confirmed so far in the 9 October theft incident involve devices sold through CryptoBilis. According to Ledger, its own systems and direct sales channels were not affected. CryptoBilis has since stopped selling all hardware wallets. ## **2. How can added hardware put crypto at risk?** Researchers, including those at Tibane Labs, have examined tampered Ledger Nano X devices. The added electronics (spyware) read the recovery phrase as it appears on the screen during setup and can send it out over a mobile connection. [Ledger Donjon](https://x.com/Ledger/status/2109896739985453358), Ledger’s security research team, has since confirmed that the implant found in a device from CryptoBilis works the same way. Anyone who has the recovery phrase can restore the wallet on another device and move the crypto. The original device isn’t needed for that. Storing the words safely on paper afterwards doesn’t undo that earlier exposure. A modified device can also pass Ledger’s authenticity check. That check verifies the secure chip, but can miss added spyware. The devices Tibane examined came from Japanese marketplaces, not from CryptoBilis. The research shows how such implants work, but doesn’t prove that all CryptoBilis thefts were carried out the same way. ## **3. How big is the incident?** In its 11 October update, blockchain analytics firm Bitquery estimates the stolen funds at **93.2 million dollars from 315 wallets**, spread across six blockchains. Ledger hasn’t confirmed this total. The number of wallets is also not the same as the number of affected people or devices. The hardware investigations shared so far mainly seem to involve the **Ledger Nano X**. Which models are affected across the full incident, and how many devices were modified, is still unknown. ## **4. What’s going on with the CryptoBilis takeover?** According to its former founders, CryptoBilis was acquired earlier this year and they handed over operations in March. Former founder Arravind Prabu says contractual confidentiality prevented them from announcing the acquisition publicly before 19 October. That acquisition and the confidentiality fuel suspicions that the reseller was deliberately taken over to distribute modified devices. But there is no established evidence that the new owner organised the tampering. Abuse of the returns process, where scammers send back modified devices that are then resold, is another possible explanation. Ledger stresses that resellers must never resell returned products. ## **5. Why are there reports from other countries too?** Because of this case, people worldwide are checking their Ledger for added hardware. X user [@0xJohannes\_](https://x.com/0xJohannes_/status/2109634513957527974) claims that several Ledger devices he bought from MediaMarkt in Germany contained spy hardware. After his first report, he says he bought another device with similar hardware. Ledger hasn’t confirmed this MediaMarkt report yet. The company is also investigating reports of implants in other devices and countries, but so far hasn’t confirmed any theft linked to a device bought outside CryptoBilis. Whether the other reports are connected to the CryptoBilis incident hasn’t been established yet. ## **6. What can you do?** Did you buy your Ledger from CryptoBilis? Ledger advises not to set up an unused device. If you’re already using it, move your crypto to a new device that comes directly from Ledger, with a **newly generated recovery phrase**. Reusing the same recovery phrase doesn’t remove the risk. Have your funds been stolen, or do you have a tampered device? Contact Ledger Support and report it to your local police. Only send the device after consulting Ledger Support or the police. If funds have been stolen, check with the police first before opening the device. You can check your Ledger Nano X for hidden spyware yourself. In the video below, our hardware specialist shows you step by step how to do it (click the image): [![Video: check your Ledger Nano X for spyware](https://start.btcdirect.eu/hs-fs/hubfs/download.jpeg?width=404&height=227&name=download.jpeg)](https://www.youtube.com/watch?v=0jEuBxvw630) *\*There are currently no indications that Ledger devices sold through Cryptomaan or BTC Direct Shop are affected.* If in doubt, contact Ledger Support through the official website. Never share your recovery phrase through a website, app, email or chat. Ledger says it never calls you unprompted, sends you a private message or asks for your recovery phrase. ## Want to be informed about important news in time? Leave your email address and only receive important updates. Keep me updated ![Close Popup](https://start.btcdirect.eu/hubfs/raw_assets/public/BTCDirect/images/cross.svg) - Start © 2026 BTC Direct ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Michiel Brunet de Rochebrune", "url" : "https://start.btcdirect.eu/blog/author/michiel-brunet-de-rochebrune" }, "dateModified" : "2026-10-13T10:31:02.133Z", "datePublished" : "2026-10-13T10:27:00.000Z", "headline" : "Ledger and CryptoBilis: what you need to know", "image" : [ "https://start.btcdirect.eu/hubfs/Screenshot%202026-10-12%20at%2016.07.19.png" ], "mainEntityOfPage" : { "@id" : "https://start.btcdirect.eu/blog/ledger-and-cryptobilis-what-you-need-to-know", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://start.btcdirect.eu/hubfs/BTC_Direct-Logo-RGB.png" }, "name" : "BTC Direct Europe B.V." } } ```