Ledger Hack 2026: What Happened and How to Check Your Wallet
A hardware wallet can look unused, work normally and pass an authenticity check while containing an extra component that steals its recovery phrase. That is the uncomfortable lesson of the Ledger and CryptoBilis case. For buyers in the United States and United Kingdom, the useful questions are specific: who supplied this unit, what does its authenticity check actually prove, and what should change if its recovery phrase may have been exposed? A familiar retailer name is a starting point for those checks, not the end of them.
What happened at CryptoBilis
Reports of theft from CryptoBilis customers emerged on 9 October 2026. Ledger confirmed an unauthorised hardware implant in a victim's device the following day. In its 15 October response, Ledger said genuine devices had been modified after leaving its control; it said its chip, operating system and servers had not been compromised. That is the company's account of the incident. Ledger's response, report on the initial confirmation.
Bitquery's estimate, verified on 16 October, is US$102 million taken from 335 wallets. That is not a count of individual victims or physical devices. Its reported US$10 million USDT freeze should not be described as money already returned to victims. Bitquery investigation.
The distinction between a counterfeit and a modified genuine device matters. A third possibility is a wallet supplied with a recovery phrase already known to someone else. A convincing box, correct logo or familiar setup screen does not resolve all three risks. Ledger's purchasing guidance.
How an implant can survive an authenticity check
Tibane Labs describes Nano X implants that intercept display data, capture recovery words and transmit them through their own cellular hardware. They do not need the owner's home Wi-Fi connection. Tibane Labs technical analysis.
Ledger's Genuine Check authenticates the Secure Element. Ledger Donjon explicitly says it cannot detect unauthorised physical modifications such as spying implants when the original Secure Element remains intact. A successful check therefore does not establish that the surrounding hardware has never been altered. Ledger Donjon threat model.
Once someone has the recovery phrase, they can reconstruct the relevant keys elsewhere. They do not need to press buttons on the original device to spend from an ordinary account they now control. Changing that device's PIN does not revoke the copied secret. What a recovery phrase controls.
Where US and UK buyers can check the seller
As checked on 25 October, Ledger's reseller directory lists Best Buy USA, Amazon USA and TikTok Shop US operated by Powerplay Retail for the United States. Its UK entries are Amazon UK and digiwallets. Start from the manufacturer's own links in the Ledger reseller directory.
These are listed sales channels, not a certification of every item offered on those platforms. They are also not a list of retailers accused of involvement in the CryptoBilis thefts.
For an Amazon order, save the actual seller identity from the offer and order confirmation, alongside the fulfilment details. Visiting a Ledger-branded storefront does not remove the need to check who is selling the selected unit. Apply the same discipline to marketplace listings elsewhere: a platform's name, a shop's display name and the legal seller can be different.
For a store purchase, retain the receipt and establish whether the unit was new stock, a display item or an open-box return. For an imported device, record the original retailer and country of dispatch. A domestic delivery address does not, by itself, describe the earlier distribution chain.
Before buying a replacement, ask about sourcing and handling of returned stock. If the seller's identity or claimed authorisation does not match the manufacturer directory, resolve that discrepancy before placing the order. No supplier choice eliminates the need to protect the recovery phrase.
Check the order and the transactions first
Start with records that do not expose a secret: receipt, order number, seller, purchase date, dispatch location and correspondence. If you used a purchasing agent or forwarding service, identify the original source as well.
Then inspect the public addresses you already know using the relevant blockchain explorers. Reading transaction history does not require entering recovery words, connecting to a random verification site or signing a message. Match any apparent balance change with actual transactions before assuming an app display issue is a theft.
Review the first setup. A recovery card already filled in, a PIN supplied by the seller or instructions to type recovery words into a website are reasons to stop. A new wallet's secret should be generated on a trusted device under your control. Ledger's safe-buying guide.
Do not initialise an unused suspect unit merely to obtain a green Genuine Check. Do not test it by restoring the recovery phrase from another wallet: that could expose a second set of assets.
What to do if your device may be affected
For an unused CryptoBilis device, Ledger's advice is to avoid setup and contact support. For one already used, the recommendation is to move assets to a trusted new device with a new recovery phrase. Do not enter any recovery phrase on the suspect unit. Ledger's notice, reported guidance for owners.
If you have other concrete evidence that your phrase was exposed, replacing the physical wallet while restoring the same words leaves the old keys in use. You need an independently generated wallet and a transfer of the remaining assets. Ledger on importing an already exposed wallet.
Verify the destination address on the trusted device's own screen, and check the network and fees before sending. Inventory every account and network derived from the affected phrase, including NFTs and DeFi positions. Stop receiving new payments at the old addresses. Do not erase your only working access before completing the migration.
If funds added for transaction fees disappear immediately, a sweeper bot may be watching the account. Repeated top-ups can increase the loss. Use the official SEAL 911 emergency assistance page to seek specialist help. Revoke.cash explains why a compromised phrase cannot be made secret again.
Reporting a theft in the United States
Preserve the transaction hashes, sending and receiving addresses, asset names, networks, amounts and timestamps. Add the receipt, seller details, shipping records and relevant messages. Keep the device and packaging, and seek instructions on preserving evidence before disassembly or return.
Report the incident through Ledger Support and the FBI's Internet Crime Complaint Center, as well as the appropriate local law enforcement channel. The FBI specifically asks for cryptocurrency addresses, transaction hashes, amounts and dates. A report does not guarantee that funds will be recovered.
Be especially cautious of anyone claiming to represent an investigator or recovery service who demands an advance payment to release your coins. Use the official reporting site rather than a link sent by an unsolicited contact.
Reporting a theft in the United Kingdom
For England, Wales and Northern Ireland, use Report Fraud. For Scotland, that service directs victims to report through 101. The reporting routes differ, so a UK-wide guide should not send every reader to the same form.
Provide the same transaction and purchase records, with the time zone clearly stated. Separately contact Ledger and the seller about the device, retaining a copy of the correspondence. A refund request for hardware and an investigation into stolen cryptoassets are different matters; do not assume either process will automatically resolve the other.
Keep the device available for examination. Before posting it back to a shop or opening the case, clarify how evidence should be preserved. Do not include your recovery phrase in a complaint, parcel or support ticket.
Should you open the device yourself
A teardown may reveal extra components, but it can also damage the screen, battery or evidence. Hardware revisions differ. A board that looks unfamiliar is not automatically malicious, and the absence of obvious wires is not proof of safety.
Useful references include Ledger's hardware integrity guide, this Nano X inspection video, and Joe Grand's implant research and recorded presentation. A Nano X walkthrough is not a set of instructions for opening a Flex or Stax.
Treat these as explanations of the hardware, not as a universal at-home clearance test. If a theft has occurred, agree on evidence handling before attempting a teardown.
Avoid a second loss during recovery
A firmware update, factory reset, new PIN or disabled Bluetooth cannot revoke a recovery phrase that has already been copied. Revoking token approvals addresses a different class of problem; it does not remove an attacker's copy of the private keys. Revoke.cash FAQ.
Download wallet software through Ledger's official site. Never type recovery words into a verification page or share them in screenshots, support messages or AI chats. Ledger says it does not provide telephone support and will not ask for the recovery phrase. Official support information.
The practical lesson for US and UK owners is to document the exact purchase, understand the limits of authenticity checks and act on specific signs of compromise. Where the secret is exposed, the destination must be a genuinely new wallet, not the same wallet inside a different piece of hardware.