$93 Million through a hole in the box: why a hardware wallet Is not a guarantee

For years, the advice to anyone holding serious crypto was simple: buy a hardware wallet. Keys stay on a secure chip, offline, out of reach of malware. In October 2026 that advice got a painful footnote.

On October 10, Ledger confirmed that a device belonging to one of its customers contained "an unauthorized hardware implant". By then, wallets bought through CryptoBilis, a reseller operating in Malaysia, Indonesia and the Philippines, had already been drained. Current estimates put losses at $72–93 million across roughly 311–315 wallets, about $70 million of it in USDT on Tron. Tether has frozen around $10 million. The count is still growing.

How the attack worked

The secure chip was never broken. It didn't have to be.

Researchers who took the devices apart, including Mark Karpelès and the team at Tibane Labs, found a small extra board hidden under the display: a microcontroller plus an eSIM with an LTE modem. During first setup, every hardware wallet shows its 24-word recovery phrase on screen so the owner can write it down. The implant read that screen and the button presses and sent the words over the mobile network straight to the attackers. No computer, no phone, no internet connection on the victim's side was needed.

From that moment the owner's wallet was effectively shared. The attackers waited for funds to arrive, then moved them out.

The tampered devices were sold at roughly half the usual price. Early implants were handmade; later ones were factory-made, which points to a production line rather than a lone tinkerer. And the problem did not stay in Asia. A German enthusiast found at least two modified units in two MediaMarkt stores. At least one had come through a European distributor. Most were sold as new, not as returns.

The check that didn't check

The most uncomfortable detail is this: Ledger's own "Genuine Check", the tool owners use to confirm a device is authentic, could not detect the implant. The check verifies the secure element. The secure element was genuine. Everything around it was not.

That is the core of the problem. A hardware wallet's security model assumes that the box you hold is the box that left the factory. Between the factory and your desk sit distributors, resellers, marketplaces, return counters and warehouses. The manufacturer does not control most of them. And once the device is sold, nobody checks it again. The buyer is the last line of defence, armed with a photo guide to what the inside of the device should look like.

What hardware wallets do and don't protect

It's worth being precise, because the conclusion is not "hardware wallets are useless".

A hardware wallet protects the key from software attacks while the key sits inside the chip. It does that well. What it cannot protect is:

•         the moment the recovery phrase is shown on its own screen;

•         the supply chain that delivers the device;

•         the owner, when they are tricked into revealing the phrase or signing a malicious transaction.

The October attack hit the first two at once.

What a real guarantee looks like

If a one-time purchase is not a guarantee, the guarantee has to be ongoing work. Security people put it this way: security is a process, not a product. For a wallet, that means:

1.       A short, controlled supply chain. The fewer hands between the vendor and you, the fewer chances to tamper. Buy only directly from the manufacturer or an official store.

2.       Keys that are generated and used in one protected place. Modern phones and hardware devices both have secure storage. What matters is that keys are created there, used there and never exported.

3.       Regular, published audits. Hardware revisions and software updates change the attack surface every few months. A single audit at launch says little about today.

4.       Checks at the moment money moves. A wallet that warns you when a transaction looks like a full-balance sweep to an unknown address gives you one more chance to stop.

Some software wallets are now built around these ideas. Ironwallet, for example, is distributed only through official app stores, keeps keys in the phone's secure storage, and connects its AI assistant through a restricted MCP layer that can use keys only locally and has no command to read them. The broader point holds for any wallet: ask how it is checked, how often, and by whom.

If you own a hardware wallet

• If you bought it from a reseller, marketplace or at a discount, treat it as suspect. Ledger advises CryptoBilis buyers not to set up unused devices.

• If the device is already in use, move funds to a new wallet with a new recovery phrase generated on hardware bought directly from the manufacturer.

• Never buy "new" wallets at half price, and never buy returned or open-box units.

• Compare the inside of your device with the manufacturer's integrity guide.

• Download wallet apps only from the official website or app store.

The chip held. The box around it didn't. That is the lesson of the biggest hardware wallet theft of 2026.