Tampered hardware wallet exposes a new supply-chain risk
This is a DailyCyber.News update, brought to you by BareMetalCyber.com, for Monday, October 12th, 2026.
Ledger has confirmed that a cryptocurrency hardware wallet sold through Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant. All confirmed cases connected to the reported October 9th draining incident involved devices sold through that reseller. CryptoBilis stopped selling hardware wallets while the investigation continued. Ledger said its own systems and direct sales channels weren’t affected.
The finding challenges a central assumption behind hardware wallets, which are intended to protect keys by keeping them offline. The available evidence doesn’t yet confirm exactly how the implant worked or whether it caused every reported theft.
For leaders, authorized reseller status shouldn’t replace strong distribution and return controls. For defenders and customers, unused devices from the affected reseller shouldn’t be initialized. Anyone who already completed setup should move assets to a new device obtained through a trusted channel and use a newly generated recovery phrase, because reusing the old phrase wouldn’t address possible exposure.
The broader lesson is that product security depends on distribution integrity as well as device design. CryptoBilis customers should follow official guidance, replace affected devices, and generate a completely new recovery phrase.
For the sources and the full Daily Cyber newsletter, visit DailyCyber.News.
