Ledger Malaysia owners have one instruction this week, and it comes from Ledger itself: if you bought your hardware wallet from the reseller CryptoBilis and have not set it up yet, do not set it up. If you have already set it up, move your crypto to a new wallet with a new recovery phrase. The company asked CryptoBilis to stop all sales and shipments on 9 October 2026, after hundreds of wallets were drained across the Bitcoin, Ethereum and Tron networks, and confirmed a day later that one affected device carried an unauthorised hardware implant.
CryptoBilis is a Kuala Lumpur reseller that appears on Ledger’s own authorised list for Malaysia, Indonesia and the Philippines. It has since paused sales of every hardware wallet brand it carries, closed its physical stores temporarily, and has been dropped as an authorised reseller by two rival manufacturers. The tampering was physical, not software: the device passed Ledger’s own authenticity check.
Last updated: 15 October 2026. This article reports what Ledger, the reseller and independent researchers have each confirmed, what remains unconfirmed, and what a device owner should do. Where a figure is an outside estimate and not a confirmed loss, we say so.
Ledger Malaysia: CryptoBilis halts sales after tampered wallets
Ledger’s own support pages carry the instruction in full. The statement was first published on 9 October 2026 and still stands as the company’s public position: no set-up on an unopened device, and a fresh seed phrase on a replacement for anything already in use.
The second statement, issued on 10 October 2026, is the one that matters legally and technically, because it is the first time anyone confirmed physical tampering rather than speculated about it.
CryptoBilis answered the same day. Its statement is the reseller’s own, in its own words, and it is the source for the scope of the shutdown.
The timeline: nine days from first report to regional halt
The sequence matters, because the pace of it is the reason other manufacturers moved. What began as a reseller problem became a supply-chain question for the whole hardware-wallet category inside a week. We have put the source next to every row, because the order of these events is the part that other buyers will end up relying on.
| Date (2026) | What happened | Source |
|---|---|---|
| 9 October | Wallets drain across Bitcoin, Ethereum and Tron. Ledger opens an investigation and asks CryptoBilis to stop selling and shipping Ledger devices. | Ledger status page; BleepingComputer |
| 10 October | Ledger confirms an unauthorised hardware implant in one affected user’s device. CryptoBilis halts sales and shipments of Ledger stock in Malaysia, the Philippines and Indonesia. | Ledger; CryptoBilis |
| 11 October | Ledger says every confirmed fund-drain report involves a device sold through CryptoBilis, and calls the affected volume “limited”. Its reseller list marks CryptoBilis “sales temporarily paused” for Malaysia and Indonesia. | Ledger; BleepingComputer |
| 12 October | Independent teardowns publish. Researchers find two implant variants in Ledger Nano X units, one bought from a China-based seller on Amazon Japan shipped from Malaysia. | Tibane Labs, via BleepingComputer |
| 13 October | Bloomberg reports Ledger has directed resellers across South East Asia and Hong Kong to suspend device sales. OneKey revokes CryptoBilis’ reseller authorisation; Trezor removes it from its authorised network. | The Edge Malaysia / Bloomberg; OneKey; Trezor |
| 14 October | CryptoBilis extends the halt to every hardware wallet brand across Malaysia, the Philippines and Indonesia, and temporarily closes its physical stores. | CryptoBilis; The Edge Malaysia |
CryptoBilis is described by Ledger and by the researchers as an authorised reseller covering Malaysia, Indonesia and the Philippines. Source: Ledger’s status page and statements; BleepingComputer, 12 October 2026; The Edge Malaysia / Bloomberg, 13 October 2026.
How the implant worked, and why the authenticity check missed it
The tampered units did not break Ledger’s cryptography. They sat beside it. Independent researchers at Tibane Labs examined two modified Ledger Nano X devices and found a microcontroller plus a cellular module built into the case. The implant reads what the wallet shows on its screen and sends the 24-word recovery phrase out over a mobile data connection. We go into the component detail below because it is the part a device owner can actually act on.
The details, as published from the teardowns, are specific enough to be worth repeating: an ST STM32G431KBU6 microcontroller (Arm Cortex-M4, 128 KB flash), a 2 x 2 mm eSIM in an eight-pad package, and a shielded LTE module. In one variant the attackers replaced the original battery with a smaller one to make room. In the other, the board sits where the foam padding under the OLED display normally is. In that second unit, the part markings on both the microcontroller and the eSIM had been scraped off.
The researchers also noted the manufacturing quality, which is the detail that turns this from an opportunist’s hack into a supply-chain question: the board was a designed, panelised flex printed circuit board of the kind ordered from a board house, not a hand-built one-off.
The same researchers pointed to a visible tell. The implant’s antenna wire runs along the top edge of the case, or is taped across the battery in the other variant. Mark Karpelès, the former chief executive of the Mt. Gox exchange, documented the hardware publicly as the reports came in.
Then comes the part that surprises device owners most. Ledger’s Genuine Check authenticates the Secure Element, the chip that holds the keys. It is not built to detect extra hardware grafted onto the board, as long as the original Secure Element has not been disturbed. A device can pass the check and still carry an implant. This is why the advice is to move the assets, not to inspect the device and feel reassured.
How much was lost? The estimates, and what Ledger has confirmed
Ledger has not confirmed a total. Every figure in circulation is an outside estimate from on-chain research groups, and they disagree with each other by a wide margin, which is itself worth knowing before quoting any of them. We have converted none of them and rounded none of them; where an outlet published a ringgit figure, that is the figure we print.
| Estimate | Who published it | Confirmed by Ledger? |
|---|---|---|
| RM420.77 million | Source: YFarmX, an on-chain research group, as converted and published by Bloomberg and The Edge Malaysia on 13 October 2026 | No |
| More than RM72 million, then more than RM86 million | Source: two separate on-chain researchers, reported by The Block, 12 October 2026 | No |
| “Limited” volume of devices | Source: Ledger’s own update of 11 October 2026, which gives no number | Yes, and it is the only figure Ledger has given |
Loss estimates are third-party, published in ringgit by The Edge Malaysia and other outlets, and are not confirmed by Ledger. Ledger has confirmed the implant in one device and says all confirmed fund-drain reports involve devices sold through CryptoBilis. Source: The Edge Malaysia / Bloomberg, 13 October 2026.
Two things can be said with confidence. First, the reported losses are concentrated in wallets whose owners bought through one reseller. Second, this is not an isolated episode: The Edge Malaysia reports an earlier bitcoin theft in 2026 from Coldcard-branded wallets made by Canada’s Coinkite, which puts this incident in a pattern rather than in isolation.
Trezor and OneKey cut ties with the reseller
The fallout spread past Ledger within days, and it spread because the same reseller carried other brands. OneKey revoked CryptoBilis’ authorisation and said it found no evidence its own users lost assets, but acted anyway.
OneKey is offering free replacements for devices bought from CryptoBilis between 1 March and 12 October 2026, with applications accepted until 31 December 2026. Trezor said it received no reports of tampered Trezor devices through the reseller and still removed CryptoBilis from its authorised network. Whether CryptoBilis’ three-country footprint changes how Malaysian buyers evaluate authorised channels is now an open question for the whole category.
Ledger’s chief executive and chief technology officer both addressed the wider problem publicly. Pascal Gauthier, the chief executive, framed physical tampering as an industry-level risk rather than a company-level incident, and Charles Guillemet, the chief technology officer, asked owners who suspect tampering to follow the company’s inspection guidelines and send the device back to Ledger rather than open it themselves.
What to do if you own a Ledger bought in Malaysia
Work through this in order. The first item is the one that expires: if the device is still sealed, leaving it sealed costs nothing, and setting it up may cost everything.
- Not set up yet? Do not start. Contact Ledger support through its own site and ask before you generate a recovery phrase on the device.
- Already using it? Create a new wallet with a brand-new seed phrase on a different device, then move the assets. Restoring the same 24 words onto replacement hardware does not undo an exposure, because the words themselves are what may have leaked.
- Do not reuse the old recovery phrase on the new device, and do not store it digitally.
- Check where the device came from. A purchase from a marketplace seller that shipped from Malaysia is, on the researchers’ evidence, in the same risk group as a purchase from the reseller. Authorised-reseller status and sealed packaging are not proof of an unmodified device.
- Do not open the device to look. Ledger warns that opening hardware can damage it. If you want it examined, contact Ledger support for shipping instructions first.
- File a police report if funds have already moved, and report it to Ledger. Ledger says it is working with the relevant authorities.
- Verify through Ledger’s own site, not through a message you received. Ledger says it will not call you, will not send you a direct message, and will never ask for your 24-word recovery phrase.
The last point is not boilerplate. An incident like this produces a second wave of losses among people who were never affected, because impersonators work the same news cycle. Ledger has said explicitly that it will never ask for a recovery phrase, and security researchers have warned that the aftermath of the CryptoBilis reports is exactly the situation fraudsters use. It is the same mechanism behind the ticket tout scam we reported in October: the fraud works because the official channel looks slower and harder than the offer.
What we could and could not confirm
Confirmed, from a first-party or named source: Ledger asked CryptoBilis to pause sales and shipments on 9 October 2026; Ledger confirmed an unauthorised hardware implant in one affected device on 10 October 2026; Ledger says all confirmed fund-drain reports involve devices sold through CryptoBilis and describes the affected volume as limited; CryptoBilis paused all hardware wallet sales and shipments; OneKey revoked the reseller’s authorisation and Trezor removed it from its authorised network.
Not confirmed: how many devices carry an implant, who installed it and at which point in the chain, the total value lost, and whether the devices sold through European retailers were linked to this incident. The loss numbers above are estimates by outside researchers that disagree with one another. Ledger has said it is reviewing those reports and has not confirmed them. We have not independently tested any device, and nothing in this article should be read as a finding about a specific unit.
One thing we are deliberately not doing: naming or describing any individual buyer, order or wallet. The technical facts are public and come from Ledger and the researchers. The victims are private.
Frequently asked questions
Is my Ledger safe if I bought it in Malaysia?
It depends on where you bought it, not on which model you own. All confirmed fund-drain reports in this incident involve devices sold through CryptoBilis, according to Ledger. If you bought directly from Ledger, Ledger says its own systems and direct sales channels are unaffected. If you bought from a marketplace seller that shipped from Malaysia, treat the device as suspect until you have moved your assets to a new seed.
Did the device pass Ledger’s Genuine Check?
A Genuine Check can pass on a tampered device. It authenticates the Secure Element chip that holds the keys, and it is not designed to detect additional hardware grafted onto the board as long as that original chip is untouched. A passed check is a meaningful signal about one component, not a statement about the whole device.
Which Ledger model was affected?
Ledger has not named a model. The independent teardowns that have been published describe the Ledger Nano X, and researchers found two implant variants in Nano X units. Treat any Ledger device bought from an unofficial channel as suspect regardless of the model printed on it.
Should I restore my old recovery phrase onto a new Ledger?
No. If the recovery phrase was captured on the tampered device, restoring those same 24 words onto replacement hardware recreates exactly the wallet the attacker already has. Generate a brand-new recovery phrase on a device you trust, then move the assets to it.
Was this a software hack or a physical one?
Physical. The attackers modified the hardware, adding a microcontroller, an eSIM and an LTE module inside the case, and left Ledger’s firmware and cryptography alone. That is why every software-level authenticity check behaved normally.
How many people were affected, and how much was taken?
Neither is confirmed. Ledger has confirmed one device with an implant and describes the affected volume as limited, without giving a number. The outside estimates of the losses, which run from more than RM72 million to RM420.77 million and disagree with each other, come from on-chain research groups and are reported by Bloomberg and The Edge Malaysia; Ledger has confirmed none of them. We report them as estimates, not as facts.
Sources
These are the documents we read, with the date each was published and the words we quoted from it. Where a figure came from an outside researcher rather than from Ledger, the row says so.
- Ledger Support, Ongoing Issues (CryptoBilis entry, created 9 October 2026; page last updated 12 October 2026) — support.ledger.com/article/15158192560157-zd
- BleepingComputer, Ledger confirms spy chip implant behind wallet crypto thefts, 12 October 2026 (the 10 October Ledger statement verbatim; Tibane Labs findings; Genuine Check limitation) — bleepingcomputer.com
- The Edge Malaysia / Bloomberg, Crypto wallet tampering fallout widens as OneKey drops Malaysian reseller, 13 October 2026 (CryptoBilis statement; OneKey statement; YFarmX estimate in ringgit; Coldcard comparison) — theedgemalaysia.com
- Tom’s Hardware, Ledger to review sales and anti-tamper policies after the hardware-wallet supply chain attack, 13 October 2026 (Pascal Gauthier and Charles Guillemet statements; teardown detail) — tomshardware.com
- Source: Quartz, Ledger is reviewing reseller controls after spy chip implants led to 90 million in crypto theft, 14 October 2026 (regional halt extended to Hong Kong and South East Asia; MediaMarktSaturn withdrawal) — qz.com
- Wikimedia Commons, Carteira-hardware-ledger.jpg, photograph by Roderart, 22 October 2022, CC BY-SA 4.0 (the device photograph; not a tampered unit) — commons.wikimedia.org
- Own capture, 15 October 2026: Ledger’s public status page, retrieved over HTTPS and cropped to the CryptoBilis entry. Read-only; nothing on any third-party service was changed.
BD Media is the editorial desk of Big Domain. This article reports statements published by Ledger, CryptoBilis, OneKey, independent security researchers and named news outlets. It is not investment, legal or security advice, and it is not a statement about any specific device. If you hold crypto on a hardware wallet bought through an unofficial channel, treat the recovery phrase as exposed and consult the manufacturer directly.
