The original uploader was Ladislav Mecir at English Wikipedia. / Wikimedia Commons (CC BY-SA 3.0)
Criminals steal an estimated $90M in crypto using tampered hardware wallets
Hidden implants in Ledger devices sold through a Southeast Asian reseller reportedly captured recovery phrases during setup
A hardware wallet exists for one reason: to keep your crypto keys away from the internet. Someone apparently found a way around that promise before the box was even opened.
Criminals stole $90 million of crypto by hiding password readers inside USB-like devices, according to the Financial Times. Estimates of the total damage run from $90 million to $93 million, drained from more than 300 user wallets.
The devices involved were Ledger hardware wallets. They were sold through CryptoBilis, an authorized reseller operating in Southeast Asia.
The attackers did not target the blockchain or the wallet software. They reportedly went after the physical hardware itself, somewhere between the factory and the customer.
How the attack reportedly worked
Unauthorized hardware implants were reportedly added to devices sold through CryptoBilis, and they were placed there before the wallets reached buyers.
The implants reportedly contained microcontrollers, which are small, cheap computer chips. Their job was to capture sensitive information shown on the wallet’s screen during setup.
The prize was the 24-word recovery phrase. When you initialize a hardware wallet, it generates this list of words as a master backup.
Anyone holding those 24 words can rebuild the wallet on a different device and move the funds. Your crypto doesn’t really live on the gadget. It lives wherever someone has those words.
The implants reportedly sent the stolen data out using LTE and eSIM technology, the same cellular connectivity found in phones and smartwatches. These tampered units reportedly carried their own cellular link, giving them a private line home that bypassed the owner’s computer and Wi-Fi.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
The coordinated thefts began on or around October 9, 2026. Most victims were in Southeast Asia, which fits the reseller’s footprint.
Ledger and Tether respond
Ledger has confirmed that at least one device was compromised. The company has also said the compromised devices are limited to those sold by CryptoBilis.
Its guidance to customers is blunt. Anyone who bought a device from CryptoBilis within the past 90 days should not initialize it.
That warning targets the exact moment the attack exploited. Setup is when the recovery phrase appears on screen, so skipping setup on a suspect unit keeps the implant from seeing anything worth stealing.
Tether, the issuer of the USDT stablecoin, has frozen USDT linked to the compromised wallets. Stablecoins like USDT are issued by a central company, which means the issuer can block specific addresses from moving tokens.
That gives victims a partial safety net, but only for that one asset. Bitcoin and other decentralized tokens have no issuer that can hit pause, so funds held in those assets have no equivalent freeze button.
Why the supply chain is the weak spot
Hardware wallets are built to survive attacks from the outside world. Malware on your laptop, phishing websites and compromised browser extensions are all threats the devices are designed to handle.
A supply-chain attack changes the rules. If the device is altered before you touch it, every security feature downstream is working for the attacker, not for you.
The CryptoBilis case also raises a question about authorized resellers. Buying from an official partner is usually the standard advice for avoiding tampered gear, yet these devices came through exactly that kind of channel.
What this means for hardware wallet users
For individual holders, the immediate checklist is short. Know where your device came from, and if it came from CryptoBilis in the past 90 days, follow Ledger’s warning and do not initialize it.
There is a market dimension too. Frozen USDT addresses affect liquidity for the tokens involved and reinforce how much power centralized issuers hold during a crisis.
The things to watch now are whether Ledger expands its list of affected devices and how much of the stolen value can be traced or frozen. For the victims, the estimated $90 million to $93 million in losses is already real, whatever the industry fixes next.