Ledger has confirmed that an unauthorized hardware implant was found in at least one affected device tied to the CryptoBilis exploit, in which as much as $93.2 million in crypto was siphoned from wallets linked to Ledger devices sold by the reseller. Tether has frozen $10 million in USDT tied to the theft while investigators continue tracing the funds. The incident, first reported about a week ago, has become one of the most alarming hardware-wallet attacks in crypto history — not because of a software bug, but because the devices themselves appear to have been physically tampered with. Anyone asking whether using Bitcoin is safe should understand this case: the vulnerability was in the supply chain, not the cryptography.

The technical account published to date describes a small board concealed behind the display of a modified Ledger Nano X, containing a microcontroller, antenna, LTE hardware and an eSIM connected to the display circuitry. The reported purpose was to monitor what appeared on the screen during setup, capture the 24-word recovery phrase, and transmit it over a cellular connection. The device could reportedly remain apparently genuine — and could pass Ledger's Genuine Check — while leaking the exact information needed to control the wallet.

On-chain analysis paints a picture of a prepared, well-resourced attacker. Bitquery traced $93.2 million linked to the exploit, reporting the hackers stole mostly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX reported a higher number — $94.5 million from 521 addresses across seven blockchains. Both estimates are based on public blockchain data, not a confirmed Ledger loss total. Bitquery also reported that dozens of wallets authorized identical requests within seconds, after roughly two weeks of small test transactions — consistent with one actor accumulating keys and then executing a coordinated multi-chain drain.

The Tether freeze is important because stablecoin issuers can block tokens linked to crime in a way that is impossible with Bitcoin or Ether. Bitquery said roughly $81 million could still be traced on-chain as of October 11, while some funds had moved through Tornado Cash and Zcash. Those traceable funds represent recovery opportunities, but the window closes as funds move through mixers.

## What Ledger owners should do now

Ledger's guidance is unambiguous: do not set up any unused device purchased from CryptoBilis in the last 90 days, and if you already set one up, transfer assets to a new device purchased directly from the manufacturer with a newly generated recovery phrase. The reseller operated in Indonesia, Malaysia and the Philippines, and reportedly changed ownership before the thefts. Ledger maintains its own systems and direct sales channels show no indication of compromise — but the company's effort to characterize the incident as confined to CryptoBilis has drawn pushback, since the reseller was listed as authorized on Ledger's own website. Remember: no Ledger employee will ever ask for your 24 words. And for everyday users, the simplest defense remains buying hardware wallets only from verified channels — the supply chain is now a proven attack vector.