Your hardware wallet may have been compromised before you opened the box.

In October 2026, a supply-chain implant was discovered in Ledger hardware wallets sold through third-party retail channels across Southeast Asia, Japan, and Europe. The implant reads your 24-word recovery phrase off the device screen during setup and transmits it to the thieves. This is an independent, community-maintained resource for affected purchasers. This is not legal advice.

Official vendor information: support.ledger.com — always type that address yourself; never follow a link someone sends you.

What happened

reported Ledger hardware wallets — primarily Nano X and Flex units — sold through certain third-party retail channels contained a malicious hardware modification: an LTE/eSIM implant interposed inside the device. During initial setup, while the device displays your 24-word recovery phrase word-by-word for you to write down, the implant reads the screen contents and transmits the phrase over its own cellular radio — independent of the Ledger Live app, Bluetooth, or USB.

Because the exfiltration happens over a radio channel the user never sees, a compromised device is indistinguishable in normal use. The first visible sign is funds leaving wallets seeded from a brand-new device — sometimes within hours of setup, sometimes weeks later.

The one rule that outranks everything on this site: no legitimate party — Ledger, a retailer, police, a lawyer, this site, or anyone claiming to be any of those — will ever need your 24-word recovery phrase, your private key, or your PIN. Anyone who asks is stealing from you. This intake form is hardened to reject seed-shaped text before it is even sealed; treat that as the standard everywhere.

What the evidence shows

Each item is tagged: documented = preserved primary evidence · reported = community or press statements, not independently verified by this project · open = unresolved question.

reported ~$72–103 million was stolen across ~311–530 wallets. These are community-aggregated estimates from victim reports and on-chain tracing; the true range is still being reconciled. Treat every total on this site as a floor pending verified accounting — see the drain data page.

reported ~$10 million in USDT was frozen by Tether. A portion of drained funds moving through Tron/Ethereum was frozen at the issuer level. Frozen funds are not returned funds — recovery requires law-enforcement process, which is why filing reports (see emergency contacts) matters even if your loss was small.

reported Affected units trace to specific retail channels — CryptoBilis (Malaysia, online and physical stores — an authorized Ledger reseller for SEA), Shopee and Lazada storefronts, Amazon Japan, Yahoo Auctions Japan, Metapod (Singapore Changi Airport), an EU reseller, and MediaMarkt Saturn (Germany). Devices bought directly from ledger.com are not currently reported affected — but if you are unsure of your unit's provenance, check the channel checklist.

open Where in the supply chain the implant was inserted is unresolved. Possibilities being examined include the contract manufacturer, a regional distribution warehouse, and in-transit interception. Attribution claims circulating on social media are unverified.

open The full serial/batch range is unresolved. Until the vendor or investigators publish affected ranges, the working assumption is: any device from a listed channel purchased in the affected window warrants the preservation protocol — whether or not it has shown symptoms.

Was your device in an affected channel?

The channels reported so far — full checklist with how-to-verify steps:

Channel	Region	Status
CryptoBilis (web + stores)	Malaysia / SEA	reported
Shopee / Lazada storefronts	MY, ID, PH, SG	reported
Amazon Japan	Japan	reported
Yahoo Auctions Japan	Japan	reported
Metapod (Changi Airport)	Singapore	reported
MediaMarkt Saturn	Germany	reported
EU reseller (unnamed pending)	EU	open
ledger.com direct	global	reported not affected

Do this right now

1. If the device is unused or unopened — do not power it on

An unopened unit is evidence. An opened-but-uninitialized unit is evidence. Do not initialize it "to check." Follow the device preservation protocol: photograph packaging and seals, keep the receipt, store the device somewhere safe and cold.

2. If you already set it up — assume the phrase is burned

Any funds under a recovery phrase generated on a suspect device should be treated as exposed. Moving them requires a new seed generated on a device with clean provenance (or a reputable software wallet on a clean machine) — never by re-entering the old phrase anywhere, including "verification" tools.

3. File reports — small losses count

Cross-referenced victim reports are what move issuers to freeze and police to investigate. Per-jurisdiction reporting channels — IC3 (US), CCID (Malaysia), KPDN (Malaysia consumer), NPA cyber (Japan), LKA (Germany), SEAL 911 for live drains in progress.

4. Expect the second scam

Victim lists are being mined. Fake "Ledger support," fake "recovery agents," and fake victim-intake sites are already circulating — some of them look exactly like this page. Read the anti-phishing page before you respond to anyone.

Dates that matter

~October 19, 2026 reported — CryptoBilis is expected to issue a public statement on or around this date. Verify against the retailer's own site before relying on it.

When	What	Why it matters
Now	Report drains to issuers + police	Freeze windows close fast — stablecoin freezes happened while reports were fresh
~Oct 19, 2026	CryptoBilis statement (reported)	First retailer position on refunds/replacement — sets the claims baseline
Varies	Consumer-protection windows (per country)	Chargebacks, small claims, and regulator complaints each have their own clocks — see emergency contacts
Years	Civil claims limitation periods	Not urgent, but organized claimants with preserved devices fare best

Get reminded: add these dates to your calendar (.ics).

Submit a sealed incident report

This site runs a sealed intake: your report is encrypted in your browser to keys held off this infrastructure before it is sent. The server stores ciphertext only — even the site operators cannot read it until you choose to release it to counsel you designate or a claimant committee. You can retrieve or delete your submission at any time from the manage page.

Submit a sealed report — channel, device model, loss range, preservation status. Takes ~5 minutes.
Check your record — confirm a receipt.
Verify a proof — ledger inclusion proofs and self-decryption, fully in-browser.
Victim report tracker — opt-in public tally, non-identifying fields only.
Drain data — public aggregate figures, all provenance-labeled.

Before you submit anywhere: this site will never ask for your recovery phrase, private keys, full serial number, remote-access to your computer, or a "verification fee." The intake form rejects seed-shaped text before sealing. Any site, DM, or phone call that asks for those is a scam — including ones impersonating this project.

FAQ

Is a device bought from ledger.com affected?
reported Not in current reports — the affected channels are third-party retail. If you are unsure of a unit's provenance, treat it as suspect and follow the preservation protocol.

Can the implant be detected without a lab?
open No reliable user-side check is documented yet. The device looks, weighs, and behaves normally. Professional teardown is the documented detection path — which is why unopened devices should stay unopened.

Should I keep using a suspect device if no funds moved?
No. A phrase read once is compromised forever — the drain can happen at any time. Quarantine the device.

Is this site run by Ledger or CryptoBilis?
No — and distrust any site that claims vendor affiliation you cannot independently verify on the vendor's own domain. This is an independent claimant-coordination resource; see privacy and the counsel page for how submissions are governed.