Ricerca verificata da fonti: OKX

What Ledger has confirmed so far

Ledger's official posts on X on 13 October 2026, one from the company and one from CEO Pascal Gauthier, set out the confirmed facts:

• Ledger disclosed the incident on 9 October 2026. On 10 October it confirmed that one affected user's device contained an unauthorized hardware implant.
• Every confirmed fund loss tied to the incident involves a device sold through CryptoBilis. Ledger says it has not verified a drain linked to a device bought anywhere else.
• CryptoBilis has confirmed it stopped selling Ledger devices while the investigation continues.
• The company says it has no indication that Ledger's own infrastructure, systems or services were compromised. The investigation is trying to establish who tampered with the devices and where in the distribution chain it happened.
• Ledger has not confirmed how many users were affected or how much was lost, and says figures circulating online come from third parties it has not fully verified.

Those third-party figures are large. Decrypt reported that on-chain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, and CoinDesk reported estimates in the same range. Until Ledger publishes its own numbers, treat them as estimates, not totals.

How the implant worked

According to Ledger's security team, the Donjon, the implant was a separate component hidden inside the device's case. It read whatever appeared on the screen. A Ledger shows the 24-word recovery phrase during setup; when the implant recognized those screens, a small microcontroller decoded the words and sent them out over LTE, the mobile-data network phones use, through a built-in eSIM.

Ledger stresses what the implant did not do: it did not modify the Secure Element (the chip that guards the keys), did not change the Ledger operating system and did not alter transactions or signatures. That is exactly why it was dangerous. A tampered device looked normal, passed its checks and signed correctly. It just leaked the one thing that matters: whoever holds the recovery phrase can rebuild the wallet on any device and move the funds without ever touching yours.

This was a physical supply-chain attack. It did not involve a software bug that an update could fix, and it did not need you to click anything. The weak point was the route the device took to reach you.

The European angle: MediaMarkt Saturn

In a second post on 13 October, Ledger said MediaMarkt Saturn, one of Europe's largest electronics retailers, has stopped selling Ledger devices in its stores and online, with Ledger's agreement, after one customer in Germany reported an implant. Ledger said no loss of funds was reported in that case and that the Donjon will examine the devices it receives. This is the first report tied to a mainstream retailer rather than a specialist reseller, which is why buyers outside Asia are now asking whether their own device is safe. Ledger has not yet said what the German device contained.

Trezor's response

Ledger's main competitor moved quickly. On 12 October, Trezor said on X that CryptoBilis was already off its reseller list, that it had no reports of tampered Trezor devices from that seller and that there was no indication Trezor devices were affected. It also told a worried owner not to force the case open, noting that a Safe 7's built-in battery makes that risky. On 13 October, Trezor said it would reduce the number of resellers it works with so it can check them more closely, adding that there is "not a single piece of evidence" its devices were compromised. Decrypt reported, citing a letter shared by Trezor's chief commercial officer, that affected resellers lose their authorization on 1 January 2027.

What to do now, depending on where you bought

A few practical points follow from Ledger's description of the attack:

1. Find your receipt. Where you bought the device is now the most important fact about it. Ledger's direct store and its listed resellers are the first places to check. 2. If you migrate, do it cleanly. A new device bought direct, a freshly generated phrase written on paper, a small test transfer first, then the rest. Re-using the old phrase on a new device does not help: if the phrase leaked, the new device is just as exposed. 3. Expect scams. Ledger warns that scammers exploit incidents like this. Fake "Ledger support" emails, texts and calls asking you to "verify" your phrase are the obvious version. Ledger says it will never contact you that way. Our lesson on scam red flags covers the common scripts. 4. Report losses. Researchers or anyone with relevant information can write to security@ledger.com, Ledger says.

How to act on this

Most hardware wallet owners do not need to do anything drastic: no drain has been verified outside CryptoBilis so far. But if you have to move coins off a suspect device today and your replacement has not arrived, an exchange account you already control can work as a short-term parking spot, provided you turn on two-factor authentication and an address whitelist before you withdraw again. If you need one, OKX accounts opened with code nexu888 return 40% of trading fees, and the OKX exchange profile explains sign-up and security settings. The Binance vs OKX comparison sets out how the two largest venues differ, and our lesson on exchange vs wallet explains the trade-off between the two. Move the coins back to self-custody once you have a device you trust.

Quick answers

Is my Ledger compromised? Ledger says every confirmed loss involves a device sold by CryptoBilis, and it has not verified a drain from a device bought anywhere else. It is still reviewing other reports, including one in Germany.

Can a firmware update fix this? No. The implant was a separate physical part that read the screen; Ledger says it did not touch the firmware or the Secure Element.

Should I open my device to check? Only if you did not buy from CryptoBilis and have backed up your phrase, using Ledger's guide; opening can damage the device. If you lost funds, speak to police and Ledger Support first.

Is Trezor affected? Trezor says it has no evidence its devices were compromised and has removed CryptoBilis from its reseller list.

How much was stolen? Ledger has not said. Third-party estimates reported by Decrypt and CoinDesk exceed $86 million.

What we could not verify

Ledger has not confirmed the number of victims, the total stolen, the contents of the device reported in Germany or where in the supply chain the tampering happened. We could not independently confirm the exact number of resellers Trezor is cutting.