Case file · Hardware wallet supply chain

The Ledger Supply-Chain Hack: Case File

In October 2026, Ledger hardware wallets bought from a trusted reseller turned out to carry implants. Owners lost an estimated $102M before anyone said a word. This file collects every investigation we ran on the case: the takeover, the implants, the money, and the strangest twist of the month.

The short version. An authorized Ledger reseller in Southeast Asia was secretly acquired; devices it shipped carried hardware implants that stole seed phrases. An estimated $102M drained from 335 wallets across six chains, with Tether freezing $10M USDT along the way. Implants later surfaced at European retail. Two weeks on: zero arrests. The trust chain was the vulnerability — buy only from Ledger's own store, and verify your device even then.

Start here

The whole case in one read.

Oct 21, 2026

The Ledger Hack Postmortem: What Broke, What Didn't, and What's Still Open

$102M from 335 wallets, two weeks on, zero arrests. The numbers, the device, the money trail, and what to check now — the case file in one place.

The attack

How the supply chain was broken.

Oct 10, 2026

The Ledger–CryptoBilis Hack: How Buying a Trusted Reseller Became the Attack

An authorized reseller was secretly acquired and its devices implanted. Full timeline of the takeover — the trust chain was the vulnerability.

Oct 13, 2026

Ledger Implants Reach European Retail: Two MediaMarkt Devices, One 'Eurasian Version' Antenna

Hardware implants found at European retail; the chain delisted Ledger group-wide. What was verified, what was speculation, what to check.

The money trail

What the chain itself shows.

Oct 9, 2026

The $86M 'Ledger Hack': What the On-Chain Evidence Actually Shows

We traced the flagged wallets on-chain: the drains, the address-poisoning overlay, and what Ledger owners should actually do.

The twist

The drain did not only hit victims.

Oct 18, 2026

The Task Scammer Who Lost 60 BTC to a Tampered Ledger Wallet

A task-scam operator kept stolen proceeds in tampered wallets — drained in a single morning. Scammers getting scammed, on-chain.

Go deeper on adjacent vectors

The same mechanics, one level down.

Hardware Wallet Scams Explained npm Supply-Chain Attacks (2026)Address Poisoning Attacks Explained Best Ways to Verify Token Addresses

Key concepts in the glossary: hardware wallet, address poisoning, supply-chain attack, seed phrase.

MAILING LIST

Read the next breakdown before Google does.

New scam breakdowns and guides land in your inbox the day they publish — before search engines index them. No noise, unsubscribe anytime.

By subscribing, you agree to receive occasional new-guide emails. Unsubscribe anytime.