// PC GAMER — GAMING
People are being robbed of crypto by a tiny chip implanted in their hardware, with $100 million said to have been stolen already
Investigation of the "draining incident of Oct 9th" is ongoing.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
October 12, 2026: User reports are beginning to surface claiming that affected Ledger wallets might not be restricted to Southeast Asia, but might also be present in Europe. There are also claims that other Ledger wallets than just the Nano X might be affected, too. There is no word from Ledger on these claims, yet.
I never got into crypto, but when I was considering doing so I was pretty quickly convinced that I should use a hardware wallet to store my private keys, as these are usually considered to pose less of a risk of being hacked and stolen than storing everything online. But alas, it seems one of the most reputable hardware wallets on the market has fallen victim of a supply chain attack (via a reseller) that's reportedly left some users short of a tidy collective sum of at least $86 million and, according to YFarmX's calculations, potentially over $100 million.
Ledger, the hardware wallet maker in question, has since said that as part of its investigation into the reports of stolen crypto, it can indeed confirm that "one of the impacted users' devices contained an unauthorised hardware implant."
The company also says, "To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis."
Ledger says CryptoBillis confirms it has ceased all sales of the wallet until the ongoing investigation is concluded. The company also says it is "working with the appropriate authorities to bring the bad actors to justice."
Judging from a disassembly of an affected device shared on Reddit, it looks like the battery was taken out to fit in the "unauthorised hardware implant." This implant, at least according to some reports, sat behind the screen where its padding should be. Importantly, the implant seems to be soldered and takes information from the screen, thereby avoiding the usual hardware tampering detection in the device.
72 hour update on reseller CryptoBilis incident 🔽
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.
We take the CryptoBilis situation seriously and are actively investigating.
We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets.
We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.
Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.
We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts.
This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users.
We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices an