Update, October 13: Ledger has published its first technical account of the implant it examined. The company says the separate component observed the recovery words as they appeared on the signer's screen, decoded them with its own microcontroller and transmitted them over LTE through a provisioned eSIM. Ledger says the component did not modify its Secure Element or operating system and did not change transactions or signatures.
That explanation, in Ledger's October 13 technical update, establishes a mechanism for the examined device. It does not establish that every reported loss involved an identical component. Ledger says every fund loss it has confirmed in the incident disclosed October 9 involves a signer sold through CryptoBilis, while reports of implants in devices from other sellers and locations remain under investigation.
The update answers the most important mechanical question left open by Ledger's October 10 confirmation: the implanted board targeted information displayed during setup rather than altering the protected chip or rewriting a transaction. That distinction explains why a genuine Secure Element could remain in the signer while a second component collected the recovery phrase outside it.
Earlier update, October 10: Ledger confirmed that one device belonging to an affected user contained an unauthorized hardware implant. Its second public statement materially changed the evidence available when this article was first published on October 9. Physical modification was no longer only a theory in this investigation.
The confirmation remains narrower than several circulating headlines. Ledger did not say that every reported loss came from an implanted device, identify who installed the component or publish a verified loss total. The company also said it had no indication that its security infrastructure, systems or services were compromised.
Ledger's 72-hour update then narrowed the confirmed scope to devices sold through CryptoBilis and said Ledger's own systems and direct-sales channels remained unaffected. The company has still not published the number of affected units, the point at which they were modified or a verified loss total.
What changed in Ledger's second statement
Ledger's October 9 statement said it was investigating loss reports from users in Southeast Asia who bought products through CryptoBilis. It asked the reseller to pause Ledger sales and shipments. Ledger's official reseller directory lists CryptoBilis for Indonesia and Malaysia and CryptoBilis PH for the Philippines.
One day later, Ledger said an affected user's device contained an unauthorized implant. It also reported that CryptoBilis had confirmed a precautionary stop to sales of all hardware-wallet inventory until the investigation concludes, a broader pause than the original Ledger-only request. Ledger said it was contacting affected users, communicating with the reseller, working with authorities and accepting information through its bounty program.
The The Verge report and crypto.news report both reproduced the initial hardware confirmation. At that stage, Ledger had not disclosed the affected model, how the component was installed or whether it transmitted information.
The October 13 CoinDesk report independently records Ledger's new account of screen capture, microcontroller decoding and cellular transmission. It also reports Ledger's position that the incident was a physical supply-chain attack rather than a compromise of the company's software or internal systems. Dev.Cooking uses Ledger's own post for those technical claims and the independent report to check the chronology and stated limits.
Dev.Cooking has not found an accessible CryptoBilis statement that independently describes the implant, its inventory controls or the expanded sales pause. Ledger's account of what the reseller confirmed is therefore attributed to Ledger rather than presented as a separate technical finding by CryptoBilis. An earlier BitPinas report found no public reseller statement when the inquiry began.
What the $86 million figure does not prove
An address count is not a victim count. One person can control many addresses, an exchange can operate addresses for many customers, and a transfer can be an internal movement rather than a theft. Dev.Cooking's guide to reading holder and wallet lists explains why address labels need transaction-level and controller-level evidence before they become claims about people.
The same caution applies to a gross total. A sum of incoming transactions to suspected destinations can include unrelated transfers, repeated movement of the same assets or amounts whose ownership has not been established. CoinDesk's first report said it could not independently confirm the above-$86-million estimate, the relationship among the listed addresses or the loss mechanism. Newer estimates are larger, but Ledger still has not published a final verified total.
The implant confirms physical tampering in one affected device. Ledger's October 13 analysis says the extra component watched the screen rather than changing firmware, transactions or the Secure Element. That finding does not establish a breach of Ledger's manufacturing systems or the presence of the same implant in every affected package. Nor does it establish where the examined device was modified or who was responsible.
That also means the headline should not expand from “devices bought through CryptoBilis are under investigation” to “all Ledger wallets were hacked.” The first proposition reflects Ledger's statement. The second is unsupported by the available record.
Why a genuine-device result is not the whole answer
Ledger's standard Genuine Check guidance says its software performs a cryptographic check to confirm that a connected device contains a genuine secure element. That can help detect a counterfeit. It does not establish that no extra component was added around genuine hardware. Ledger's October 13 finding makes that limitation concrete: the company says the implant was separate from the Secure Element and operating system.
Ledger's standing recovery-phrase guidance says the company will never ask users for the 24 words and that the phrase should never be shared. A legitimate setup generates the phrase on the device. A card, message or website that supplies a ready-made phrase should be treated as unsafe.
For buyers inside Ledger's stated CryptoBilis window, the incident-specific instruction takes priority over a routine authenticity check. Ledger told people with an unused device not to initialize it. Those who already initialized one were told to consider moving assets to a new signer created with a new recovery phrase. Users should reach Ledger through official support rather than links sent in replies, direct messages or unsolicited email.
Moving assets is not merely changing hardware. A new device restored from the same old recovery phrase controls the same accounts. Ledger's warning specifies a new recovery phrase because the aim is a new signing secret, not a new screen around an existing secret. Anyone taking that step should verify the destination address on the trusted device display and make a small test transfer before moving the remainder.
What the confirmation still does not answer
A conclusive account still needs more than a technical description of one implant or a final dollar figure. Ledger has not publicly identified the device model it examined, said whether the package passed the genuine-device check or shown how the modification entered the distribution path.
Investigators also need to connect reported withdrawals to specific customers and devices without collapsing addresses, accounts and people into one count. A hardware implant in one device does not independently prove that the same design caused every loss attributed to the incident. Phishing, seed exposure and unrelated wallet activity remain possible alternative explanations for some reports unless transaction and device records rule them out.
CryptoBilis can also add important evidence by publishing its own chronology, affected stock records and preservation steps. Ledger's statement says the reseller stopped hardware-wallet sales, but it does not disclose how many units remain in circulation or which orders, regions and dates investigators are reviewing.
The responsible reading has moved again. One examined implant had a described collection and transmission path, and Ledger ties all fund losses it has confirmed in this incident to CryptoBilis-sold signers. A Ledger-wide compromise, a single cause for every public loss claim and a final victim or loss count are still not established.
Reporting and image notes
Original Dev.Cooking news analysis updated after Ledger's October 10 hardware confirmation, October 11 scope update and October 13 technical explanation. Ledger's dated posts, reseller directory and security guidance are the primary records. Independent reports from CoinDesk, BitPinas, The Verge and crypto.news were used for chronology and to check what remains unverified. Sources for the latest update were reviewed October 13, 2026. The cover is Motokoka's real 2019 Ledger Nano S photograph, licensed CC BY-SA 4.0. It was cropped, resized and converted to responsive WebP files; the adaptation is shared under the same license. The pictured device is not identified as a CryptoBilis purchase or investigation evidence. No affiliation or endorsement is implied. Corrections: Hello@dev.cooking.