Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.
Perspective Coverage
6 publishers
- Builder
- Builder 23%
- Operator
- Operator 44%
- Investor
- Investor 33%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+12
- Incentives55
- Confidence60
Ledger disclosed on October 13 that an implant in a signer sold by CryptoBilis captures 24-word recovery phrases and sends them over LTE. Every fund loss Ledger has verified involved devices bought through that reseller.
Perspective Coverage
8 publishers
- Builder
- Builder 23%
- Operator
- Operator 48%
- Investor
- Investor 29%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence70
Ledger announced the Atom, a data-only Android signer, while pausing sales in southeast Asia after reports of over $86 million in stolen crypto. Ledger says the Atom's tamper detection would have stopped the implants, but it is not due until summer 2027.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+35
- Incentives65
- Confidence62
Ledger confirmed on Oct. 10 that one affected customer's wallet held an unauthorized implant, after drains that trackers put near $93 million. That proves tampered hardware reached a victim, but investigators have not tied comparable equipment to the rest of the losses.
Perspective Coverage
22 publishers
- Builder
- Builder 24%
- Operator
- Operator 44%
- Investor
- Investor 32%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+18
- Incentives55
- Confidence72
Ledger bars resale of returned wallets after implants sent recovery phrases over cellular links
Ledger suspended reseller sales in seven Asian markets and barred resale of returned wallets after implants captured recovery phrases. Independent blockchain investigators estimate losses above $86 million, a figure Ledger has not verified.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives60
- Confidence45
Trezor will end its resellers' authorization on January 1, 2027, days after Ledger found an LTE spy implant in wallets sold by CryptoBilis. Trezor says there is no evidence its own devices were compromised.
Perspective Coverage
7 publishers
- Builder
- Builder 24%
- Operator
- Operator 47%
- Investor
- Investor 29%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence66
MediaMarktSaturn pulls Ledger wallets in every country after an implant report in Germany
MediaMarktSaturn has pulled Ledger wallets from its roughly 1,070 stores and websites in every country it operates in. Ledger ties every confirmed case to a Southeast Asian reseller, but one buyer says he found modified units at two MediaMarkt stores.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap−10
- Incentives50
- Confidence45
On-chain analyst Specter traced more than $86 million drained from hundreds of Ledger hardware-wallet users across Ethereum, TRON and Bitcoin. With the cause unconfirmed, holders cannot yet tell whether moving coins to a new device would help at all.
Perspective Coverage
10 publishers
- Builder
- Builder 27%
- Operator
- Operator 44%
- Investor
- Investor 29%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence60
Researcher reports a Ledger bought in Europe that appears to carry a hardware implant
Ledger said in its October 11 update that every confirmed case in the October 9 draining incident involved devices sold by CryptoBilis. It has not tied a researcher's possibly implanted European device to that investigation.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence35
Suspected Ledger wallet thefts near $90 million under investigation as buyers from reseller CryptoBilis report losses
Ledger paused sales through authorized reseller CryptoBilis after investigators put suspected losses among its customers near $90 million. How the wallets were breached is still unknown. Ledger's fix is a new device with a fresh recovery phrase, which puts the suspicion on the sales channel.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence35
Ledger halts sales at Malaysian reseller CryptoBilis while it investigates user losses
Ledger told Malaysian reseller CryptoBilis to stop all sales while it investigates losses a pseudonymous analyst puts above $86 million. For anyone holding crypto on hardware wallets, the shop each device came from is now part of its security.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence40
Brevo says an intruder reached 120 customer accounts and used them to mail phishing from those customers' own domains. Three crypto companies confirmed their newsletter lists were hit. Only one named the provider.
Perspective Coverage
4 publishers
- Builder
- Builder 15%
- Operator
- Operator 69%
- Investor
- Investor 16%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−20
- Incentives40
- Confidence70
Polymarket's signup flow treated a stolen SSN as a password
According to the Wall Street Journal, nearly 500 Polymarket US accounts were entered by people who typed in someone else's Social Security number. The flow's duplicate-identity check opened the account it matched instead of blocking the attempt.
Reality
- Evidence55
- Adoption72
- Hype gap−15
- Incentives70
- Confidence55
Brevo says a long-lived Cloudflare key with full account permissions sat in its application source code, and the Worker built with it stripped Content-Security-Policy headers from scripts that Sansec estimates reach 100,000 sites.
Perspective Coverage
3 publishers
- Builder
- Builder 34%
- Operator
- Operator 48%
- Investor
- Investor 18%
Reality
- Evidence78
- Adoption60
- Hype gap+20
- Incentives58
- Confidence72