On 9 October 2026, Ledger said it was investigating reports of customers in Southeast Asia losing funds from wallets they had set up correctly. A day later it confirmed that at least one affected device carried an unauthorised hardware implant. Every confirmed case so far traces back to one reseller, CryptoBilis, which is based in Malaysia and also sells in the Philippines and Indonesia. That is the Ledger CryptoBilis incident in one paragraph.
Estimates of the loss sit between US$86 million and US$93 million, spread across roughly 300 wallets. The investigation is still running and the numbers may move.
We sell a different brand, so read what follows with that in mind. We get asked about this most days now, and it is nearly always the same question: could this happen to me, and what should I do about it?
What happened in the Ledger CryptoBilis incident
Here is the timeline, keeping to what has been published.
- 9 October 2026. Ledger announces an investigation into fund losses reported by users in Southeast Asia and asks the reseller involved to pause sales.
- 10 October 2026. Ledger confirms an unauthorised hardware implant in at least one affected device.
- Scale. On-chain analysts first put the losses above US$86 million. Bitquery later estimated US$92.9 million across 311 wallets on five blockchains, and its analysis points to a single actor controlling the stolen keys. Tether has frozen around US$10 million in linked USDT.
- The common factor. All confirmed cases involve devices bought through CryptoBilis, a Malaysia-based reseller. Trezor has removed CryptoBilis from its authorised list and says it is shrinking its reseller network from 1 January 2027. OneKey has revoked the reseller’s authorisation and is offering free replacements for devices bought there between 1 March and 13 October 2026.
One point deserves emphasis because it keeps getting lost. Ledger’s secure element was not broken. The chip did its job. The attack happened around it, in the physical device, after it left the factory.
How the implant worked
Ledger hasn’t published a teardown of the CryptoBilis devices. The best public look at this kind of implant comes from an earlier case. In August 2025 someone posted photos on Reddit of a Ledger Nano X they had bought second-hand in Thailand, with an extra board inside. Hardware researcher Joe Grand spent months taking that device apart and presented the teardown at hardwear.io USA 2026. What he found describes that one device. The CryptoBilis implants may differ, and the investigation is still going.
A second board had been glued inside the case, wired to the Nano X’s test points, with its own antenna, and the battery was smaller than it should have been. The secure element sends the pixels for the screen across an internal bus (SPI), unencrypted. During setup that screen shows your 24-word recovery phrase. The implant listened on the bus, decoded the words, and sent them to a remote server over a cellular modem with a data-only eSIM.
From the owner’s side, nothing looked wrong. The device powered on, set up normally, and passed Ledger’s built-in authenticity check. The attacker only had to wait for funds to arrive.
Why the authenticity check didn’t catch it
A genuine-device check is a cryptographic conversation with the chip. It proves the chip is a real one with real firmware. It can’t see a second board glued next to it, because that board never talks to the chip. It only listens.
Ledger has said as much: if the original secure element is intact, its Genuine Check can’t detect an added implant. The only reliable way to find one is to open the case, which can damage the device. That isn’t a criticism of Ledger in particular. Any wallet that moves secrets across an internal bus to a screen has the same blind spot.
The other ways a wallet gets tampered with before you open the box
Implants are the dramatic version. The supply-chain attacks that have actually been documented over the years are a mixed bag.
- Counterfeits. In 2023 Kaspersky analysed a fake Trezor Model T bought through a classifieds site. The main chip had been swapped and the firmware modified so the “random” recovery phrase was picked from a list of 20 the attacker already knew. They waited about a month before emptying it.
- Fake replacement devices. In 2021 scammers mailed altered Ledger Nano X units to people whose details had leaked, with a letter claiming the original was being recalled. The package included a hidden flash drive and a fake app that asked for the recovery phrase.
- Restocked returns. A device that was bought, altered and sent back can end up on the shelf for the next customer. Ledger has since told its authorised resellers to stop restocking returned products and to source stock only through official channels.
- Poisoned software. Instead of touching the device, the attacker tampers with a library or app that talks to it.
What a Tangem card does and doesn’t protect against
Honest version first. A Tangem wallet is not immune to supply-chain risk in general, and no vendor should tell you theirs is. What it has is a much smaller surface to attack, and a check that covers more of that surface.
Nowhere to put an implant
A Tangem card is a Samsung secure element (certified EAL6+) and an NFC antenna sealed into a single card. There is no screen, no battery, no USB port and no internal wiring carrying secrets to another component. With no power source there is nothing to run a hidden module; the card only wakes for the few seconds it sits in your phone’s NFC field. The private key is generated inside the chip and never leaves it. An unsigned transaction goes in, a signature comes out, and both end up public on the blockchain anyway.
The attack Joe Grand documented, reading secrets off the wire to the screen, has no equivalent here. There is no wire and no screen. A seedless Tangem setup also never displays a recovery phrase at all, so there is nothing to photograph or transcribe during setup. If you choose to add a seed phrase later, that part of the risk comes back, which is one reason we don’t push people to do it.
What the app checks every time you tap
Each chip generates its own key pair during manufacture, and Tangem registers the public half on its attestation server. When you tap a card, the app runs three checks before it will do anything: the card’s identity against that register, the integrity of the wallet on it, and the hash of the firmware. A counterfeit card fails at the first tap. A card with altered firmware fails at the third. And because the firmware is written once at the factory and cannot be updated, there is no later window in which someone could flash something different.
Tangem’s own position is that you can buy a card from anyone, because the attestation covers the thing that matters. There is one condition attached, and it’s the important one.
If the app says the card was preactivated, reset it
A new card should arrive with no wallet on it. You create the keys on first use, on your own phone. If the Tangem app tells you the card has already been activated, that means somebody has set it up before you, and in principle they could hold a copy of the backup. Don’t use that wallet. Reset the card to factory state in the app and create a fresh wallet, or send it back to the seller.
The same rule applies to any hardware wallet of any brand: a device that comes with an existing wallet, a pre-printed recovery phrase, a PIN already set or an access code already set is not new, whatever the packaging says.
What it doesn’t cover
The card can’t protect you from a compromised phone showing you a wrong address, from a phishing site that talks you into typing a seed phrase, or from someone who has your card and your access code. Those are the ways Tangem users actually lose money, and none of them involve the hardware. If you want the full list of realistic attacks, we went through them in Can a seedless wallet be hacked?
What this means if you’re buying in New Zealand
New Zealand is a small market, and a lot of hardware wallets here arrive through grey channels: overseas marketplaces, Trade Me listings, a mate who bought a few on a trip. CryptoBilis is a regional reseller for the countries just north of us, and in the Ledger case the warning signs were invisible to the buyer. So the question of where you buy is not paranoia. It is the single variable you control.
What we’d suggest, for any brand:
- Buy new, from a seller you can hold to account. Tangem NZ is an authorised New Zealand seller. Stock is held in Auckland and the Consumer Guarantees Act applies to the sale. If something is wrong, you have a local company to deal with rather than a dispute form on an offshore marketplace.
- Avoid second-hand wallets entirely. The device Joe Grand pulled apart was second-hand. A wallet is the one product category where “barely used” should put you off, not reassure you.
- Install the app from the App Store or Google Play only. Never from a link in an email, a QR code in the box, or a search ad.
- Expect a fresh setup. Keys get created on your phone, by you, on first tap. Anything else, stop.
- Look at the physical item. For a Tangem card this is easy: it is a flat card with nothing to open. For a device with a case, look for resealing, odd adhesive or misaligned labels, and compare the weight with the maker’s published spec. The implanted Nano X had a smaller battery.
- Send a small test amount first and leave it for a while before moving anything significant. The Trezor counterfeit case waited a month. A test deposit that sits untouched for a few weeks is cheap reassurance.
We’ve written before about how to buy a Tangem wallet in NZ without getting a fake and about buying locally in Auckland. Both are still accurate. The Ledger incident just raised the stakes on the advice.
If you already own a Ledger bought through a reseller
We’re not going to tell you to throw it away. Start with Ledger’s own guidance. All confirmed cases so far involve CryptoBilis, so if yours came direct from Ledger or through a known authorised seller, there is no published evidence of a problem. If it came via CryptoBilis or a marketplace seller you can’t identify, treat it as suspect: move your funds to a wallet set up fresh on a device you trust, with a new recovery phrase or a seedless setup. Don’t reuse the old phrase. The phrase, not the device, is what gets stolen.
FAQs
Buy genuine Tangem wallets from Tangem NZ, an authorised New Zealand seller with stock in Auckland and NZ$ pricing including GST. If you have questions about a wallet you already own, from us or anyone else, get in touch and we’ll give you a straight answer. We will never ask for your access code or seed phrase.
