Ledger wallet tampering suspected after reports of crypto thefts

A spy implant in some Ledger crypto wallets may be the root of an $86 million supply chain attack.

Terrence O'Brien

Oct 10, 2026, 4:36 PM UTC

Image: Cath Virginia / The Verge, Turbosquid

Terrence O'Brien

is the Verge’s weekend editor. He’s covered the tech industry for over 18 years and knows a thing or two about synths.

Reports have been mounting that users of the Ledger crypto wallet have seen theiraccounts drained, and suspicion is that it’s related to reseller CryptoBillis and a bit of spy hardware. Ledger has asked CryptoBillis topause all salesof its wallets while it conducts an investigation.

Photos and videosposted on XandThreadsappear to show asmall circuit boardsandwiched under the screen. The implant allegedly intercepts anything displayed on the screen, including the seed passphrase shown during the initial setup. Using an embedded SIM card, the implant then sends that information back to the attacker, who can then siphon funds from user accounts.

Reports indicate that whoever is behind the hack has stolenover $86 million worth of cryptofrom hundreds of wallets. There’s no indication that Ledger’s systems have been compromised or that wallets purchased directly from the company have been affected. Instead, the issue appears to be a supply chain attack primarily involving users in Southeast Asia and the CryptoBillis reseller. Ledger has providedguidanceon how to check if your wallet has been tampered with.

Follow topics and authors

from this story to see more like this in your personalized homepage feed and to receive email updates.