Monahan traces most new Ledger loss reports to recovery phrases typed into phishing sites
Security researcher Taylor Monahan says most fresh Ledger loss reports trace to owners who handed recovery phrases to scammers. Estimates of the episode's losses run $70 million to $100 million, and Ledger says every verified case traces to one reseller.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence45
Ledger had 219 days between a researcher's implant report and the CryptoBilis wallet losses
Researcher Joe Grand says he told Ledger of an implanted Nano X on March 4, 219 days before the Oct. 9 CryptoBilis wallet losses. The case that Ledger gave no public warning rests on Grand's criticism and Mark Karpelès saying he has seen none.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+25
- Incentives45
- Confidence45
Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 44%
- Investor
- Investor 33%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+12
- Incentives55
- Confidence60
Ledger plans to release its Android-based Atom wallet in mid-2027, after a breach that onchain researchers put at up to $93.2 million. It plans no trade-ins for customers hit by the tampering, so victims who want the new hardware will pay for it.
Perspective Coverage
11 publishers
- Builder
- Builder 33%
- Operator
- Operator 34%
- Investor
- Investor 33%
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+30
- Incentives65
- Confidence62
Ledger disclosed on October 13 that an implant in a signer sold by CryptoBilis captures 24-word recovery phrases and sends them over LTE. Every fund loss Ledger has verified involved devices bought through that reseller.
Perspective Coverage
8 publishers
- Builder
- Builder 23%
- Operator
- Operator 48%
- Investor
- Investor 29%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence70
Ledger announced the Atom, a data-only Android signer, while pausing sales in southeast Asia after reports of over $86 million in stolen crypto. Ledger says the Atom's tamper detection would have stopped the implants, but it is not due until summer 2027.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+35
- Incentives65
- Confidence62
Ledger confirmed on Oct. 10 that one affected customer's wallet held an unauthorized implant, after drains that trackers put near $93 million. That proves tampered hardware reached a victim, but investigators have not tied comparable equipment to the rest of the losses.
Perspective Coverage
22 publishers
- Builder
- Builder 24%
- Operator
- Operator 44%
- Investor
- Investor 32%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+18
- Incentives55
- Confidence72
Solana Mobile picks Ledger as its first hardware partner for the Seeker app
Ledger will ship its Atom with Solana Mobile's Seeker app preinstalled, delivery estimated for the second quarter of 2027. The announcement came five days after Ledger confirmed a hardware implant in an affected user's device.
Reality
- Evidence40
- Adoption30
- Hype gap+25
- Incentives65
- Confidence55
Ledger bars resale of returned wallets after implants sent recovery phrases over cellular links
Ledger suspended reseller sales in seven Asian markets and barred resale of returned wallets after implants captured recovery phrases. Independent blockchain investigators estimate losses above $86 million, a figure Ledger has not verified.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives60
- Confidence45
Ethena CEO says a large investor's ENA transfers were a security precaution tied to the Ledger hardware wallet scare, not a sale
Ethena CEO Guy Young says a large ENA holder's transfers were a security precaution after the Ledger attack. Researchers put the thefts at up to $93.2 million, and every holder who moves to a fresh signer leaves a trail that looks like an exit.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+10
- Incentives55
- Confidence50
MediaMarktSaturn removed all Ledger products from its stores and online platforms over tampering reports. The public German evidence is an X user's claim that two wallets held cellular modules. Ledger did not answer Cointelegraph on whether it has confirmed any tampered device in Europe.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 42%
- Investor
- Investor 35%
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+25
- Incentives
- Not scored
- Confidence60
Ledger asked resellers in seven Asian markets to pull its wallets from shelves on October 14. It has not tied a suspected implant in a Flex from a second reseller to the first cases, so how far the tampering reaches is open.
Perspective Coverage
7 publishers
- Builder
- Builder 16%
- Operator
- Operator 51%
- Investor
- Investor 33%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+15
- Incentives50
- Confidence62
Joe Grand found swapped chips in two Trezor wallets that generated preset seed phrases
Joe Grand told Trezor in August that two of its wallets carried hardware implants, zetter-zeroday.com reports. Trezor's commercial chief has since written that there is no evidence of compromise as the company trims its authorized sellers.
Publishers:zetter-zeroday.com
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives55
- Confidence50
Trezor will end its resellers' authorization on January 1, 2027, days after Ledger found an LTE spy implant in wallets sold by CryptoBilis. Trezor says there is no evidence its own devices were compromised.
Perspective Coverage
7 publishers
- Builder
- Builder 24%
- Operator
- Operator 47%
- Investor
- Investor 29%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence66
Spy chip soldered into Ledger Nano X wallets reads the screen and transmits over an eSIM
Ledger told owners of Nano X wallets bought from CryptoBilis to discard them after spy chips were linked to more than $86 million in thefts. A Nano X bought in Europe and a Ledger Flex have since been reported with the same implant.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence50
MediaMarktSaturn pulls Ledger wallets in every country after an implant report in Germany
MediaMarktSaturn has pulled Ledger wallets from its roughly 1,070 stores and websites in every country it operates in. Ledger ties every confirmed case to a Southeast Asian reseller, but one buyer says he found modified units at two MediaMarkt stores.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives50
- Confidence45
X users say tampered Ledger wallets also came from MediaMarkt in Germany and LazMall in the Philippines, beyond the CryptoBilis batch Ledger confirmed. Karpelès has examined pictures of the LazMall unit; the MediaMarkt claim rests on one account.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence55
Three knife-wielding intruders took about $800,000 from a UK trader, he says, including $720,000 from a Ledger hardware wallet. Police have not confirmed it; Chainalysis counts over $30 million in confirmed losses from such attacks in the first half of 2026.
Perspective Coverage
4 publishers
- Builder
- Builder 18%
- Operator
- Operator 50%
- Investor
- Investor 32%
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence58
On-chain analyst Specter traced more than $86 million drained from hundreds of Ledger hardware-wallet users across Ethereum, TRON and Bitcoin. With the cause unconfirmed, holders cannot yet tell whether moving coins to a new device would help at all.
Perspective Coverage
10 publishers
- Builder
- Builder 27%
- Operator
- Operator 44%
- Investor
- Investor 29%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
France's €100,000 crypto wallet reporting rule is absent from the budget text the Assembly now debates
France's Assembly finance committee adopted a rule making holders of €100,000 or more in self-custody crypto report it or face fines up to €10,000. The same committee then voted 31 to 3 against the budget's revenue section, and the government's original text contains none of its crypto amendments.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+25
- Incentives40
- Confidence55
Earlier coverage
- OneKey revokes reseller CryptoBilis and will replace any OneKey device bought there since March 1
Science · October 12, 2026 · Confirmed3 publishers
- Europe's Ledger implant case rests on a single MediaMarkt unit with no stolen funds
Invest · October 12, 2026 · Confirmed2 publishers
- Sui's $500 million Hashi pledge tests whether institutions will put idle bitcoin to work
Invest · October 8, 2026 · Confirmed3 publishers
- 4,200 BTC walked off Liquid behind an on-chain note claiming white-hat intent
Invest · September 6, 2026 · Confirmed7 publishers
- Blockstream bets forensic tracing beats paying a $32m bounty for the last 598.5 BTC
Invest · September 11, 2026 · Confirmed7 publishers
- Ledger brings floating-rate Morpho loans to wallets it says secure almost 30% of retail bitcoin
Invest · October 7, 2026 · Confirmed2 publishers
- Liquid's thieves set a patch as the price of returning 4,000 BTC
Security · September 7, 2026 · Confirmed7 publishers
- SafePal's breach came through an order-tracking plug-in, and that is the point
Product · August 16, 2026 · Confirmed3 publishers
- A hardware wallet's real attack surface is its order database, not its air gap
Invest · August 16, 2026 · Confirmed4 publishers
- Order data ShipMonk promised to delete pushes Trezor's breach count to 80,700
Invest · September 4, 2026 · Confirmed2 publishers
- JSCeal drives the victim's own browser to take over their Google account
Security · September 8, 2026 · Confirmed2 publishers
- MacSync hides its next-stage commands in public iCloud calendar events
Security · September 24, 2026 · Confirmed2 publishers
- SlowMist puts 14 iOS versions inside one Safari key-theft chain
Invest · September 21, 2026 · One report1 publisher
- ClickFix in the sidebar: Def Con follow-up phishing turns a real Google Doc into the payload
Security · August 20, 2026 · Confirmed2 publishers