Developing story, last reviewed 10 October 2026. Loss estimates, affected-device scope and the cause may all change. Ryder makes a competing hardware wallet, so weigh this accordingly.
The Ledger wallet drain reports that surfaced on 9 October carry one instruction that matters today, and it applies to a narrow group. If you bought a Ledger from the reseller CryptoBilis in the last 90 days, Ledger says to leave the device alone if you have not set it up yet, and to move your assets to a new device with a newly generated recovery phrase if you have. Everything else is still being worked out, and the gap between what has been traced and what has been proven is wide enough to be worth spelling out.
What the Ledger wallet drain numbers say now
The first figures came from two on-chain researchers on 9 October. tanuki42 tied more than 72 million USD to eight addresses, and Specter put the total above 86 million USD across Bitcoin, Ethereum and Tron. Those two lists overlap heavily: between them they name ten distinct addresses, and seven appear on both, so the two totals are overlapping reads of one cluster rather than figures to be added together.
A fuller count has since landed. Bitquery's on-chain investigation puts the total at 92.9 million USD taken from 311 wallets across Tron, Bitcoin, Ethereum, BNB Chain and Polygon, with figures verified as of 9 October. Bitquery's account of why its number is higher is the useful part: the earlier estimates were built from the ten public addresses and missed BNB Chain, Polygon and five further Tron drain addresses. It also reports that Tether froze 10 million USD of USDT across 20 wallets, that roughly 79 million USD remains traceable on chain, and that 1,254 ETH went into Tornado Cash on the afternoon of 9 October. We have not reproduced that dataset ourselves, and a wallet count is not a count of people.
The pattern that points at one attacker
Bitquery's timing evidence is harder to explain away than any single total. It reports that 25 Tron wallets signed the same approval within three seconds of each other, following roughly two weeks of smaller test runs. Dozens of wallets moving on one signal in that window is difficult to produce by phishing dozens of separate people, and it fits a single party already holding the keys to all of them.
What the implant research shows, and where it stops
Running alongside the loss reports is a separate strand of hardware research that explains how an authentic-looking device could leak a recovery phrase. Tibane Labs has published a photographed teardown of implanted Ledger Nano X units, documenting three generations since the first public report in August 2025.
The mechanism matters because it sidesteps the part everyone asks about. The implant is a second small computer soldered to the display's data lines, and it reads the words as they travel to the screen during setup, then sends them out over its own cellular modem and eSIM. It never touches the secure element, which is why Ledger's own authenticity check still passes, because the chip itself is untouched Ledger hardware. Tibane's third-generation specimen is cut to fit around the Ledger's own components so it drops into place without measuring, which the lab reads as a design optimized for installation in bulk.
Here is the limit, and it is the reason this story has two halves rather than one. The two specimens Tibane examined were bought on Yahoo! Auctions in Japan and on Amazon Japan from a China-based seller, so neither came from CryptoBilis. Tibane calls its investigation ongoing and says the losses are not confirmed. An observed implant, a workable mechanism and a traced theft are three separate findings, and joining them needs evidence from the devices that were drained.
What an authorized reseller is, and what it is not
CryptoBilis is an authorized Ledger reseller in Indonesia, Malaysia and the Philippines, which is the detail that makes this worth a buyer's attention. Being authorized is a commercial arrangement. It says a seller may stock and sell the product, and it says nothing about who handled the box between the factory and the customer.
Ledger has said there are no reports involving devices bought directly from Ledger. CryptoBilis's former co-founders, in a statement sent to Tibane Labs, say the company was acquired by new owners earlier in 2026, that they completed a handover in March 2026, and that they have had no access to its systems since. None of that identifies where in the chain a device could have been altered, and no finding so far places an implant in a CryptoBilis unit.
What this does not establish
It is worth being blunt about the claims this story will not support. Nothing reviewed here shows a flaw in Ledger's secure element or a firmware exploit. No cause has been confirmed. No victim count has been independently verified. There is no evidence that devices bought from Ledger directly, or from other sellers, are affected. The implant research and the drained wallets have not been connected by evidence from a single affected device.
Ledger moved quickly once reports appeared, asking the reseller to pause sales and shipments and publishing unusually direct advice to recent buyers. That response deserves saying out loud in a week when the brand is taking a beating.
If you bought from a reseller in the last 90 days
Leave an unopened device unopened. If yours is already set up, treat the recovery phrase as exposed and move the assets to a device where you generated the phrase yourself, watching it appear on the screen for the first time. A phrase that was ever known to someone else cannot be made private again, so importing the same words into different hardware carries the exposure with it.
If you have already lost funds, the crypto security response group SEAL 911 and Ledger's own support channels are the two places to start, and Bitquery's address list is worth checking against your own outgoing transactions. Treat anyone who contacts you promising recovery as part of the problem.
What we take from this, and what we are not claiming
We did not examine any device, interview any affected owner, or reproduce any of the on-chain work above. This is sourced reporting, and we are a competitor in the same market, which is reason to hold our conclusions to a higher bar rather than a lower one.
The durable lesson is about the path a wallet takes to reach you. Buy from the manufacturer where you can, and treat first setup as the moment that decides everything: a wallet should generate its own recovery phrase in front of you, and a device that arrives already configured, or with words printed on the card in the box, belongs back in the post. The Ryder One generates keys inside its secure element during that first setup and renders every transaction on screen before you approve it, and we would say the same about any device that does those two things. What we will not claim is immunity from physical tampering, because no comparative testing exists that would let us.
For anyone caught in this, follow Ledger's current guidance rather than advice from a company selling an alternative. If you are thinking further ahead about how a backup should be arranged, our recovery documentation explains how we split ours.
Share: