Overview
- Ledger told reseller CryptoBilis to pause all sales on Oct. 9, 2026 and urged customers who bought from that seller in the past 90 days not to initialize devices while it investigates.
- Pseudonymous and commercial on‑chain investigators traced roughly $86 million to $90 million in outflows from hundreds of victim wallets across Bitcoin, Ethereum and TRON and flagged a notable Bitcoin address holding about 211 BTC.
- An independent researcher published photos claiming a hidden LTE/eSIM implant inside a Ledger purchased in Malaysia but that physical‑implant allegation remains unverified and Ledger says it has no indication purchases made directly from Ledger were compromised.
- Tether has frozen USDT linked to the flagged addresses to block movement of some stolen funds, but most assets are on chains Tether cannot freeze and any restitution will require cooperation from exchanges, custodians or courts.
- The episode highlights supply‑chain risk for hardware wallets after earlier 2026 incidents and leaves affected users facing immediate steps to move assets to newly initialized devices with fresh recovery phrases.