If you purchased your Ledger device directly from Ledger’s official website, your funds are safe and your device is not affected by the recent $87 million exploit. Ledger’s internal investigation has confirmed that every reported case of the drain is tied to hardware units distributed by the third-party reseller CryptoBilis. The manufacturer maintains that its own production systems, firmware, and direct-to-consumer supply chain remain uncompromised, shifting the focus to a localized supply chain attack at the reseller level.
The incident surfaced in early 2026 after a surge of unauthorized transactions prompted a forensic audit of affected devices. The investigation revealed that the compromised units sold by CryptoBilis likely underwent unauthorized tampering or pre-configuration before reaching the end user. In response to these findings, CryptoBilis has officially ceased all sales of hardware wallets and is reportedly cooperating with international law enforcement to identify the point of entry for the attackers.
This breach underscores a critical vulnerability in the global crypto hardware supply chain, emphasizing why the industry standard remains purchasing directly from the manufacturer. For US-based investors, this event may prompt the Federal Trade Commission (FTC) to tighten oversight on third-party electronics resellers who handle cryptographic security modules. The incident serves as a stark reminder that even the most secure hardware can be undermined by a compromised intermediary.
Market participants should watch for further updates from Ledger regarding potential compensation for affected CryptoBilis customers and any secondary alerts for other regional resellers. Users are advised to utilize the 'Genuine Check' feature in Ledger Live, though Ledger notes that in the case of sophisticated supply chain attacks, even a 'genuine' device could be compromised if the recovery seed was intercepted. Moving forward, the industry may see a shift toward more transparent, blockchain-verified shipping logs to prevent similar hardware interceptions.