Ledger has some reassuring news: its security chip was not hacked. People staring at empty wallets can take a moment to work out how pleased they should be.

On October 9, 2026, crypto was stolen from people who had bought devices through reseller CryptoBilis. Bitquery’s figures, checked on October 15, put the losses at roughly $102 million across 324 wallets. That is the researchers’ estimate; Ledger has not confirmed it.

Someone watched you enter the safe’s code

On October 13, Ledger described the implant found in one victim’s device. An extra component inside the casing read the 24 recovery words from the screen during setup and sent them to the attackers over a mobile network. The security chip, the device’s operating system and transaction signatures were left untouched.

Those words make up the seed phrase. For a standard wallet without an additional passphrase, they let someone restore access on another device. The thief no longer needs your Ledger. They do not even have to touch its buttons.

Imagine a safe with an excellent lock. Someone hides a camera beside the keypad and watches you enter the code. The lock passes every test. The contents of the safe somehow fail to appreciate the achievement.

Authentic device. Unexpected contents.

Ledger offers a device authenticity check. Its own hardware inspection guide states the limitation: the check cannot detect physical modifications, including spying implants, if the original security chip remains intact.

“A genuine Ledger” and “nobody added anything inside” are different claims. An engineer can understand the distinction. For a buyer who paid for protection and whose device passed the check, learning the difference can cost a lifetime’s savings.

The next step has a certain elegance. The same guide provides pictures to help you inspect the internals, alongside a warning that opening the device can damage it. You bought a wallet to spend less time worrying about security. Now you have a reason to study circuit boards.

The black box had company

Blaming a random bargain seller is awkward here: CryptoBilis appeared in Ledger’s official reseller directory. Investigators are still establishing who altered the devices and where it happened.

This is where the promise of peace of mind starts to crack. The buyer is asked to trust the manufacturer, seller, delivery process and contents of the box. Then it turns out the check answers only part of the question. Everything the check leaves out suddenly becomes the buyer’s personal problem.

In this case, the attackers did not even need to change the device’s software. They added their own observer. There was room for a thief inside a genuine device.

This is not a confirmed breach of the Ledger Live app, nor evidence that every Ledger is compromised. In its October 14 update, Ledger said inspections of stock held by German retailers and distributors found no tampering; it had not yet received the suspect devices shown online. That limits what we can say about the scale. It does not make the implant already found any less real.

What buyers should do now

For CryptoBilis customers, Ledger’s advice is straightforward: do not set up an unused device; if you have used one, move funds to a new wallet set up on a trusted device with a new seed phrase. Reusing the old phrase does not erase a copy the thief may already hold. Do not enter it into a website offering a “security check.”

The card stores. You encrypt.

Trust also depends on what you are asking the device to do.

A Mitilena card is a vault for data you encrypt yourself. You choose a password, use it to encrypt your data, and save the encrypted data to the card.

You can read a record stored in the standard NFC format with an ordinary app such as NFC Tools. Reading the card does not decrypt the data. You do the encrypting. The card stores what you put on it.