Ledger's Tampered Hardware Hack Spreads To Europe As Losses Near $95 Million
A hardware wallet hack that started with one reseller in Southeast Asia has widened into Europe. Blockchain analytics firms now put the total stolen somewhere between $93 million and $94.5 million, and a second tampered device has turned up at a major European retailer.
THE SOUTHEAST ASIA HACK, BY THE NUMBERS
The losses trace back to Ledger devices sold through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia and the Philippines. Ledger confirmed that at least one affected device contained an unauthorized hardware implant, physical modifications including extra wiring and an LTE module capable of transmitting stolen data. Blockchain intelligence firm Bitquery traced $93.2 million drained from 315 wallets across six chains, while security platform YFarmX put the figure as high as $94.5 million from 521 addresses across seven chains. Ledger has not confirmed either total. Tether froze $10 million in USDT connected to the theft, and on-chain researchers say roughly $81 million of the stolen funds can still be tracked.
A SECOND TAMPERED DEVICE TURNS UP IN EUROPE
An X user posting as Johannes said he bought a second Ledger device from a different MediaMarkt location, recorded the unboxing, and found spyware again, with the same additional cabling and LTE module found in the Southeast Asia devices. Store records traced that inventory to Aqipa GmbH, an official Ledger distributor in Europe since 2023. Because Aqipa supplies retail stock broadly across the continent, any store that receives inventory through it, including MediaMarkt and Saturn locations, could be exposed. That network covers more than 1,000 stores across 11 countries. A MediaMarkt employee reportedly confirmed the device was not a returned unit, since returned Ledgers go back to the manufacturer rather than getting resold. Ledger's CTO said the company was not certain Aqipa is the direct distributor between Ledger and MediaMarkt, though the evidence points that way. Ledger has not confirmed the European device is part of the same attack, and some users reviewing the published photos disagree about whether the hardware shown is genuinely tampered.
WHO ACTUALLY OWNS CRYPTOBILIS
CryptoBilis co-founders Arravind Prabu and Vimal Selvamany say they sold the company in March 2026 and have had no access to its backend systems, customer databases, or administrative accounts since. Corporate records show a Chinese national named Jiaming, based in Heilongjiang province, became the sole shareholder as of August 3. A confidentiality clause in the acquisition agreement blocked a public announcement of the sale until mid-October, though suppliers had reportedly already been told. "We are no longer part of the company," Prabu wrote, adding that both founders have offered to give Ledger historical records to help its investigation. The founders' statement names Nicholas Chang as the person currently running CryptoBilis. No public evidence yet ties the ownership change itself to the hack.
WHERE THE STOLEN COIN WENT
On-chain trackers have followed the thief moving funds in batches, running Ethereum through Tornado Cash multiple times and then into Zcash's shielded pool before pulling it back out again. Despite the mixing and the privacy coin's shielded pool, analysts have been able to follow the money step by step, which undercuts the idea that routing stolen funds through Zcash actually keeps them untraceable.
WHAT TO DO IF YOU BOUGHT A LEDGER FROM A RESELLER
Ledger has advised CryptoBilis customers not to activate unused devices and to move funds on already-active devices to new hardware with a freshly generated recovery phrase. The same advice extends to anyone who bought a device through a reseller rather than directly from Ledger, especially in the regions now in question. Ledger has not issued a recall, and it has not confirmed how far the European exposure actually extends. Until it does, the decision to keep funds on a reseller-bought device or move them now sits with the person holding that device.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
