Ledger: one implanted device confirmed, loss estimates run from $72 million to $93 million, none confirmed

Loss estimates run from more than $72 million to $93.4 million, and Ledger has confirmed none of them

The published estimates of what was taken from drained Ledger wallets run from more than $72 million to $93.4 million. That is a spread of about $21.4 million, and the highest is about 30 per cent above the lowest (both derived). Counting a balance snapshot of about $71.5 million that one outlet printed on 9 October, the widest gap between any two figures is $21.9 million (derived). Ledger has confirmed none of them. The six Ledger posts read for this briefing, from 9 to 11 October, contain no loss figure and no count of victims, only that "The volume of impacted devices is limited."

A spread is not a loss total. The estimates were made at different times, from different sets of addresses, by different people counting different things, and the table below says which is which. The record also does not establish why the wallets were drained. On 10 October Ledger confirmed that "one of the impacted users' devices contained an unauthorized hardware implant". It has not said how the implant works, how many devices carry one, or that it explains the losses. The most detailed description of a device comes from an outside buyer whose account is unverified, and this briefing frames it as one person's claim.

Ledger's own posts were read on x.com, logged out, from 11:19 BST on Monday 12 October 2026, with three Ledger support pages and Ledger's security-research page on device genuineness. No Ledger blog post or press release about the incident was found, and Ledger's Academy pages returned a notice that certain pages are restricted in the UK. Eight news outlets were read: Help Net Security (12 October), The Block, Protos, Decrypt, Cointelegraph, Gizmodo, Bitcoin Magazine and CoinDesk. So were the blockchain analytics firm Bitquery's own investigation and the research page of the outside buyer, which holds the device photographs. Where they differ, the article says so. Everything was read between 11:14 BST and 11:39 BST on 12 October 2026, and any of it can change within hours.

Whose figures, from when, and what each one counts

Decrypt, The Block and Protos report the lower figures, and Help Net Security and CoinDesk the higher ones, which they attribute to on-chain researchers. The table separates the figures by who made them and what was counted. The researchers are pseudonymous individuals and are referred to here by role; their handles are in the sources.

Published loss figures for the 9 October drains, as read on 12 October 2026. US dollars. None is confirmed by Ledger.

Figure	Whose, and when	What it counts
About $71.5 million	An Arkham Intelligence custom label that Gizmodo calls unverified, Friday 9 October.	A balance still sitting in flagged addresses that afternoon. Not a loss total.
More than $72 million	An on-chain researcher, eight addresses, 9 October (The Block, Cointelegraph).	Funds that had moved to those eight addresses.
More than $86 million, or nearly $87 million on Arkham data	A second on-chain researcher, ten addresses, 9 October (The Block, Protos, Decrypt, Bitcoin Magazine).	Inflows to ten addresses on Bitcoin, Ethereum and Tron. The researcher later said the number of victim wallets was not yet known (The Block).
Nearing $90 million	ChainCatcher, relayed by KuCoin on 9 October, citing unnamed third-party security firms.	Not stated. The origin cannot be checked.
$93.2 million	Bitquery, a blockchain analytics firm, figures verified 11 October. Help Net Security (12 October) says more than $93 million.	Money that left 315 victim wallets on six blockchains, at 9 October prices.
$93.4 million	An analyst account cited in Cointelegraph's weekly digest, 471 addresses.	Counted by address. The method was not read.

Three things explain most of the gap, on Bitquery's own account. First, address sets: the lowest researcher estimate listed eight addresses and the next listed ten, a step of $14.0 million (derived). Second, coverage: Bitquery says the ten public addresses received $85.4 million. It removes $0.8 million for a third Bitcoin address it treats as a separate operation, then adds $6.3 million in five Tron addresses that no public list includes, $2.0 million on BNB Chain and Polygon, and $0.25 million on Solana. The sum, 85.4 minus 0.8 plus 6.3 plus 2.0 plus 0.25, is $93.15 million, which rounds to its $93.2 million (derived). Third, definition: Bitquery counts only money that left a victim's wallet, and says some early totals counted money moved between the thief's own wallets twice. The Block noted on 9 October that it was unclear whether the two early estimates covered the same transactions. Bitquery sells blockchain data products and promotes them in its report, so its count is both a finding and a showcase. It also publishes its method and the limits of its figures.

The estimate is also still moving, and it is not a net loss. Bitquery says drains continued after Ledger's first post and that its total counts the drain of 9 October only. It reports that Tether froze about $10.0 million of USDT in 20 wallets, and adds that a freeze stops coins moving but "It does not send them back to victims." Whether any of it is returned is not stated in anything read. The figures also count wallets, not people or devices. Bitquery says one owner can have several wallets, and its mean of about $296,000 per wallet (derived: $93.2 million over 315) hides one Tron wallet that lost $7.0 million.

Nor is every drained wallet shown to belong to a CryptoBilis buyer. Decrypt wrote on 9 October that it was unclear whether every theft is linked to the reseller, and one on-chain researcher told Cointelegraph he was not certain but knew of no victim report that did not involve it. Bitquery reads the chain as showing one actor holding the keys to every drained wallet after two weeks of practice runs, and adds: "The chain cannot show where the keys leaked from."

What Ledger has said, post by post, and the 72 hours

These are Ledger's words, copied from the posts. Times are BST as displayed on each post. The posts were readable without a login, so this is the primary text, not a relay.

Ledger's posts about the incident, read on x.com on 12 October 2026. Quotations are exact and short.

When (BST)	What Ledger said	What it left out
Fri 9 Oct, 14:32, Ledger Support	Investigating "reports of loss of funds" from users in South East Asia who bought from a reseller named CryptoBilis. Asked it to pause all sales and shipments. Buyers "in the last 90 days" should not set up; if set up, "consider moving assets to a new Ledger signer (with new seed)".	Cause, count, loss figure.
Fri 9 Oct, 17:54, Ledger	"we believe the funds drained are limited to devices sold through a reseller named CryptoBilis in South East Asia". No indication that its own infrastructure, systems or services were compromised.	The basis for "believe".
Sat 10 Oct, 18:09, Ledger Support	"Ledger can confirm that one of the impacted users' devices contained an unauthorized hardware implant." The reseller confirmed it ceased sales of all hardware wallet inventory. Working with authorities. Users who bought from this reseller should not set up.	How it works, how many devices, whether it explains the drains. No "90 days".
Sun 11 Oct, 11:53, Ledger	"There is no indication that devices purchased on Ledger.com have been tampered with." Wherever you bought, you can inspect your device with Ledger's hardware-integrity tutorial.	"No indication" is not a test result.
Sun 11 Oct, 18:13, Ledger (the 72-hour update)	"The volume of impacted devices is limited." All confirmed cases tied to the 9 October draining involve devices sold through the reseller. Resellers reminded to source only through authorised channels and "never to restock returned products". Says it is "reviewing authorized reseller controls". "For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger."	A number, a loss, a cause, a window.
Sun 11 Oct, 19:32, Ledger	A reply to the poster of a claim about a device bought at a European reseller: "Please refer to the latest update".	Any answer to that claim.

Timing, derived from the timestamps above and Bitquery's timeline. Ledger's first post came 8.4 hours after the first drain Bitquery records, at 06:07 BST on 9 October, and 1.5 hours after two researchers posted their address lists. The implant confirmation followed 27.6 hours after the first post. The "72 hour update" was posted 51.7 hours after the first post and 60.1 hours after the first drain. Counted back 72 hours from its posting, the clock would have started at 18:13 BST on Thursday 8 October, before any drain on record, so the label does not count from any event in the record, and Ledger does not say what it counts from. In calendar days, the update came 2 days after the first customer reports on 9 October.

Ledger's wording is careful in a way worth reading twice. "All confirmed cases" and "to date" describe what Ledger has confirmed, which is a count of what it has examined and not a boundary of what exists. "No indication" describes the absence of a finding, and the posts do not say how many devices Ledger has opened.

Stated and not stated: what the record establishes and what it does not

"Not stated" means not found in Ledger's posts and pages, or in the outlets that quote them, read in full. It does not mean the information does not exist.

What Ledger's posts and pages and the other sources state about the incident, and what none of them states. Read 12 October 2026.

The question	Stated on the record	Not stated
Why were wallets drained?	Ledger (10 October): "one of the impacted users' devices contained an unauthorized hardware implant".	That the implant explains the drains. Gizmodo reports Ledger has not tied it to the loss estimates. Bitquery: the chain cannot show where each wallet's keys leaked from.
How does the implant work?	Nothing from Ledger. An outside buyer describes a second board that reads what is sent to the screen during set-up and sends the recovery phrase out over a cellular link. That is his claim.	Ledger's own account, a photograph from Ledger, or an independent teardown of a device from the reseller. The buyer's own page says no device sold by CryptoBilis has been tested.
How many devices?	"The volume of impacted devices is limited."	A number. Bitquery counts 315 drained wallets, which is not a device count.
Who altered the devices, and where in the chain?	Ledger: all confirmed cases tied to the 9 October draining involve devices sold through the reseller, which "has confirmed having ceased all sales".	Whether the reseller or an earlier or later link did it. Gizmodo wrote on 9 October that nothing public has shown the shop altered devices, and nothing read since changes that. A statement attributed to the reseller's former co-founders, relayed by an outside lab and not verified by Gizmodo, says it changed hands earlier in 2026. That is not evidence of wrongdoing. No public statement by the reseller was found.
What was the total loss?	Nothing from Ledger. Estimates in the table above.	A confirmed figure, a victim count, or the net after freezes.
Can a Genuine Check detect an implant?	Ledger: a Genuine check "cannot detect unauthorized physical modifications to the hardware" if the original secure element remains intact.	Whether the secure element was intact in any drained device.
Are other channels affected?	Ledger (11 October): no indication that devices bought on Ledger.com were tampered with. "Our systems and direct sales channels remain unaffected."	Any test of other channels. The outside buyer says he bought two implanted units on Japanese marketplaces in September. An unverified claim about a European reseller circulates, and Ledger has not addressed it beyond "Please refer to the latest update".

Where the outlets differ, and which one this briefing follows:

• Where the buyer bought. Help Net Security says he bought a tampered Ledger in Malaysia. Gizmodo and his own page say his units came from Japanese marketplaces, one shipped from Malaysia. This briefing follows his page.
• What the spyware steals. Protos says it is designed to steal "passkeys". The buyer's description and every other outlet say the recovery phrase. This briefing follows the others.
• Whether tampering is confirmed. Decrypt wrote on 9 October that no tampering had been confirmed. Ledger confirmed one implanted device the next day, so that line is overtaken.
• The reseller. Cointelegraph's weekly digest states as fact that the reseller had "recently been sold to a new owner" and that its devices "were found to be modified". The first rests on the unverified statement above, and the second goes beyond Ledger's confirmation of one device. This briefing does not repeat either as fact.
• The date of the update. A Chinese-language aggregator relayed by KuCoin dates Ledger's 72-hour update to 12 October. The post itself is dated 11 October, and this briefing follows the post.
• Size of the loss. Protos headlines $86 million and writes "over $80 million" in its text. The table above separates the figures by author.

One buyer's claim: photographs, shrink wrap and a Genuine Check that passed

The most detailed public account of the implant is from an outside buyer, not Ledger. According to Help Net Security, he posted photographs and videos that appear to show a small extra circuit board where the screen's padding would normally sit. He says it carries a microcontroller, an antenna, an LTE chip and an eSIM, and that it watches what is shown on the screen, notes the recovery phrase as it is displayed and transmits it. He also says his device arrived in intact shrink wrap and passed Ledger's Genuine Check because the security chip inside is real. Treat all of that as one person's unverified account. Ledger has not confirmed any part of the description, and no independent examination of the device was found in anything read.

Three details limit how far it reaches. First, Help Net Security says he bought the tampered device in Malaysia. Gizmodo says he has not said it came from CryptoBilis, and his own research page says its two implanted units were bought on a Japanese auction site and from a China-based marketplace seller whose parcel shipped from Malaysia. The page adds: "We have not tested any device sold by CryptoBilis". Second, Gizmodo reports his statement that photographs from CryptoBilis buyers since Ledger's alert show the same class of implant, which is a claim. Third, his page dates the first public report of a similar implant to August 2025, which would make the class older than this reseller, and that too is his account.

Claims that circulate about the implant, who makes each, and their status on 12 October 2026.

Claim	Who says it	Status
The device passed Ledger's Genuine Check.	The outside buyer (Help Net Security).	Unverified for any specific device. Consistent with Ledger's own statement that the check cannot detect such a modification if the secure element is intact.
It arrived in intact shrink wrap.	The outside buyer.	Unverified. Ledger's security-research page says seals can give "a false sense of security".
CryptoBilis devices carry the same class of implant.	The outside buyer, from photographs sent to him (Gizmodo).	Unverified. Ledger has confirmed one implanted device and published no photograph or teardown.
A device bought at a European reseller carries an older version.	An X user with photographs.	Unverified. Cointelegraph reports that no funds have been taken from it. Ledger has not addressed it.

Does the Genuine Check test the secure element or the whole device? The secure element only, on Ledger's own account. Ledger's support page says each device is given a secret key during manufacturing, and that "Only a Ledger signer with a genuine secure element can complete this verification process, ensuring your hardware is not a counterfeit." Its security-research page calls the process attestation, "used to check the genuineness of Ledger secure elements", and says it runs when a device first connects, each time Ledger Wallet is opened, on every app install and on every firmware update. The same page says: "Note that a Genuine check cannot detect unauthorized physical modifications to the hardware, such as spying implants, if the original Secure Element remains intact." It adds that the check "cannot verify the device's physical supply chain history". A device with an extra board would therefore pass every one of those checks (inference from Ledger's text). That is why the buyer's claim is plausible, and still only a claim.

Hardware that is the problem before the owner touches it is not new to this site: the briefing on malware shipped in cheap Android firmware covers another case.

The 90-day window: the funding dates reach back to June, and Ledger's wording has moved

Bitquery checked when each Tron, Bitcoin and Ethereum victim wallet first received money. Its words: "Of those wallets, 6 in 10 got their first coins inside that window, and more than 8 in 10 got them from June onward." The window is Ledger's 90 days. June alone accounts for 42 of the 131 Tron victim wallets, or 32 per cent (derived). Help Net Security repeats the point and concludes that devices bought from the reseller since June may also be compromised.

The arithmetic, all derived. Ninety days before Ledger's 9 October post is 11 July. From 1 June to 11 July is 40 days, and from 1 June to 9 October is 130 days, about four and a third months. If about 6 in 10 first funded inside the window, about 4 in 10 did not, so a 90-day rule would miss roughly 40 per cent of these wallets by first-funding date. More than 2 in 10 of them, the gap between "more than 8 in 10" and "6 in 10", were first funded between 1 June and 10 July. Bitquery publishes rounded fractions, so the exact share cannot be computed. If "6 in 10" stands for 55 to 65 per cent, the share outside the window runs from 35 to 45 per cent.

Two limits apply. First, Bitquery says a wallet's first payment "does not tell us when its owner bought a device". By inference, a device is bought before its wallet is funded, so a wallet first funded before 11 July came from a device bought before the window opened, unless the owner restored an older phrase onto a new device. That makes about 4 in 10 a lower bound on the share whose devices were bought before the window. Second, the premise has moved. The 90 days appear in Ledger's post of 9 October. Ledger's posts of 10 and 11 October say "users who purchased a Ledger device from this reseller" and "For CryptoBilis buyers", with no window, and Cointelegraph's and CoinDesk's reports of those posts leave it out as well. Bitquery, which says Ledger's advice covers the last 90 days and advises following it "even if you bought it before July", and Help Net Security, which quotes that sentence, describe the older wording. A buyer from the reseller should read Ledger's current wording as covering any purchase, not only the last 90 days (inference from the posts as read).

Four friendly names, and what Ledger's own pages say about each

A label that sounds like a control is not one unless something is tested. Four appear in this story, and Ledger's own pages say what each does and does not do.

Labels in the story, what each sounds like, and what Ledger's pages and posts say. Pages read 12 October 2026.

The label	What it sounds like	What the record shows
Authorised reseller	Ledger vetted the seller, so the stock is safe.	Ledger tells buyers to use its shop or its authorised network, and its security-research page says that is "safer". CryptoBilis was listed as an authorised reseller for Indonesia, Malaysia and the Philippines (Cointelegraph, Gizmodo). On 11 October Ledger said it is "reviewing authorized reseller controls". No audit of reseller stock is described in the pages read.
Genuine Check passed	The whole device is untouched.	It tests the secure element only. Ledger: it "cannot detect unauthorized physical modifications to the hardware" if the original secure element remains intact.
Sealed in shrink wrap	Nobody has opened it.	Ledger's security-research page: seals "can give a false sense of security" and it is "easy to open and close a package without damaging the seal". The outside buyer says his arrived in intact shrink wrap.
Hardware wallet	The keys never leave a protected chip.	The chip protects the keys, but the 24 words must be shown once on a screen outside it, and Ledger's support page says "The information on your device is the source of truth". An implant on the screen path, as the buyer describes, would not need to touch the chip (inference from his claim).

Which of these is a control? On the pages read, none of the four protects against a genuine unit modified on its way to you. The controls Ledger names are different ones. One is the owner's own inspection of the inside of the device against the official layout, which Ledger's integrity page describes and warns will void the warranty and risks electrostatic damage. Another is a blank recovery sheet and no pre-set PIN, which guard against pre-seeded devices, a different attack. The remedy after exposure is a new device and a new recovery phrase. Buying direct is Ledger's advice, and on 11 October it said there is "no indication" that devices bought on Ledger.com were tampered with. That is the absence of a finding, not a test result.

Each side has an interest. Ledger sells the wallets and the direct route, and rival wallet makers have used the incident to market their own products (Gizmodo), so any account of which channel is safe carries a commercial interest. Ledger's reseller page adds that on marketplaces such as Amazon the "Ledger Authorized Store" may be run by an authorised reseller, not by Ledger directly.

The UK: buy direct, expect no safety net, and report through Report Fraud

For a UK buyer of a hardware wallet, or a business that holds crypto treasury or buys security hardware, the UK sources read say less than readers might hope. The table shows where each stops.

UK sources read on 12 October 2026, and where each stops.

Source	What it says, as read	Where it stops
NCSC supply chain security guidance (reviewed 22 October 2025)	"Effectively securing the supply chain can be hard because vulnerabilities can be inherent, or introduced and exploited at any point in the supply chain." The principles include knowing who your suppliers are and a right to audit in contracts.	Written for large organisations, the public sector and security professionals. The five pages read (the overview, the principles overview and principles I to III) concern suppliers' security and contracts, and do not mention inspecting boxed hardware for tampering or counterfeits. No mention of hardware wallets.
The same NCSC guidance, on Cyber Essentials	Certification gives assurance that suppliers have "fundamental technical controls" and are protected from "untargeted, commodity attacks".	A certified reseller would be telling you about its own systems, not whether a unit in a box was modified before it reached you. Tampering of this kind is targeted (inference).
Report Fraud (GOV.UK, 4 December 2025; reportfraud.police.uk)	A new service that replaces Action Fraud as the national platform for reporting cyber crime and fraud. Report at reportfraud.police.uk or on 0300 123 2040, the number that remains unchanged. In Scotland, report through 101.	A report goes to police. Nothing read says it recovers funds. It covers England, Wales and Northern Ireland.
Ledger's UK notice, on its support and shop pages	"Cryptoassets are high-risk investments and you should not expect to be protected if something goes wrong."	Ledger's wording, not a regulator's. No UK regulator page on cryptoassets was read.
Follow-up scams: Ledger (10 and 11 October) and North Wales Police (31 March 2026, in local press)	Ledger: "Ledger will never call you, DM you, or ask for your 24-word recovery phrase." In March, police warned of postal letters to Ledger owners, using data "from previous Ledger customer data breaches", with a QR code to a fake site asking for the phrase.	The police warning was read in local press, not at source. No link between that campaign and this incident is shown.
Ledger's reseller list, read from the UK	Lists Amazon UK and one online shop as authorised. Says marketplace stores may be run by a reseller, not Ledger.	Whether the UK Amazon store is run by Ledger or a reseller is not stated.
Ledger's Academy pages, requested from the UK	A notice: "Due to new rules in the UK, certain Ledger.com webpages are restricted."	The support, security-research and shop pages loaded. A UK buyer may find some official buying guidance unavailable and should use the support site.

Two points follow for a business. First, the NCSC guidance treats the supplier relationship as the control, and this incident shows that the relationship label, "authorised", was not enough on its own. The receiving step, where the buyer records the route and checks the unit, is a control the business has to own. Second, for a treasury, an arrangement in which one device's recovery phrase cannot move the funds alone limits what a single tampered unit can do, provided the devices come by independent routes. That is inference. None of the sources read tests it.

This site's earlier briefing on Report Fraud's new service and its reported figures covers how the reporting service changed.

What to do, in the order worth doing

These steps follow Ledger's own advice where it gives some, and say so where they are inference. They apply to any hardware wallet, because the labels in this story are not specific to one maker.

What could not be verified

• Loss figures. Ledger confirms none. The "nearing $90 million" figure comes from unnamed firms via an aggregator and cannot be traced. Bitquery's $93.2 million is its own count, and the $93.4 million method was not read.
• The implant. Ledger's own words are one sentence. Everything about the design comes from an outside buyer and his research page, which is not independent of the claim, and no independent teardown of a CryptoBilis device was found.
• The Genuine Check claim and the shrink wrap. One person's account, with no test record published in the pages read.
• Who altered the devices, and where. Not stated. CryptoBilis has made no public statement that was found. The ownership statement is attributed to the former co-founders by an outside lab, and Gizmodo could not confirm it. Other accounts of the reseller's ownership were not repeated, because they rest on unverified screenshots.
• The European reseller claim. Unverified, and Ledger has not addressed it beyond "Please refer to the latest update". The retailer is not named here for that reason.
• Share outside the 90-day window. About 4 in 10 is derived from Bitquery's rounded "6 in 10", and a first-funding date is not a purchase date.
• Newer Ledger statements. The latest Ledger post read was at 19:32 BST on 11 October. The @Ledger and @Ledger_Support timelines were loaded again at 11:38 BST on 12 October, with the 72-hour update pinned on the first and the 10 October update on the second, and no newer standalone post. Replies are not shown on those pages, so a newer reply may exist. No Ledger blog post or support article about the incident was found.
• Not read. Bitquery's raw data, the North Wales Police release itself, any UK regulator page on cryptoassets, and the Ledger Academy buying guides, which returned a UK restriction notice and were not bypassed.
• Time-stamped. Sources were read between 11:14 BST and 11:39 BST on 12 October 2026. A post, a loss figure or a page could change within hours.

The question that exposes the gap

When a label says a device is genuine, authorised or sealed, which part of the device was tested, by whom, and on the unit in your hand?

Key facts