The standard advice for anyone moving crypto off an exchange is simple: buy a hardware wallet from an authorised reseller, then run the maker's authenticity check. In Southeast Asia, buyers who followed both steps may still have lost their coins.
On 13 October 2026, Ledger said its Donjon security team had confirmed unauthorised LTE implants inside signers sold by CryptoBilis, a reseller listed as official in Indonesia, Malaysia and the Philippines. According to Ledger, the implant read the 24-word recovery phrase off the screen during setup and sent it out over a mobile network using an eSIM. Ledger's own Genuine Check could not flag it, because the secure chip itself was untouched.
That detail matters for Indonesia, where CryptoBilis sold through a local company and storefronts on Tokopedia and Shopee. It also lands 28 days before Web3 Week Asia, the crypto and blockchain event in Jakarta on 11-12 November 2026, where custody and security sit squarely inside the agenda.
What Ledger confirmed. An unauthorised implant inside the device enclosure that captured the recovery phrase at setup and transmitted it over LTE; no change to the Secure Element, the operating system, transactions or signatures, per Ledger as reported by CoinDesk and The Block on 13 October 2026.
Estimated losses. Between more than US$72 million and US$93.2 million, depending on the on-chain researcher; Ledger says it has not verified any of these figures.
Who sold the devices. CryptoBilis, an official Ledger reseller in Indonesia, Malaysia and the Philippines, which has since suspended sales of all hardware wallet brands in those markets.
Industry response. Trezor and OneKey both removed CryptoBilis as an authorised reseller and say they found no affected customers; MediaMarkt Saturn in Germany pulled Ledger devices from sale on 13 October 2026 after a customer reported an implant.
Status. As of 07:30 WIB, 14 October 2026, Ledger says the investigation into who tampered with the devices, and where in the distribution chain, is ongoing.
How the attack worked, and why the checks missed it
Most hardware wallet security assumes a remote attacker. This one sat physically inside the box. Ledger says the implant did not need to break the Secure Element, the chip that stores keys, because it simply watched the display at the one moment the full recovery phrase appears in plain view.
Researchers at Tibane Labs, cited by BleepingComputer, described two variants: a cruder version using a smaller replacement battery, and a more refined one that ran on the original battery and sat where the display's foam padding normally goes.
Why this matters: Ledger has said that authenticity verification is not enough to rule out an implant in a physically modified device. The check confirms the secure chip is real; it does not inspect what else was added to the board.
The numbers: a range, not a total
The loss figures come from independent on-chain researchers, not from Ledger. The researcher known as tanuki42 traced more than US$72 million to a group of suspected theft addresses on 9 October 2026, as reported by The Block and Liputan6. A second researcher, Specter, later put losses above US$86 million across the Bitcoin, Ethereum and Tron networks. CoinDesk reported on 13 October 2026 that on-chain researchers estimated up to US$93.2 million across more than 300 wallets.
The Block noted that it is unclear whether these estimates cover the same transactions and addresses. That is why this article gives a range and does not add them up. Ledger itself describes the number of affected devices only as "limited" and says every confirmed loss so far involved a device sold by CryptoBilis.
There is one partial offset. According to CoinDesk, Tether froze US$10 million of USDT tied to the theft.
Why the "official" label became the weak point
CryptoBilis was not a grey-market listing. Ledger, Trezor and OneKey all named it an authorised partner until the incident.
The reseller responses show where the industry thinks the gap is. According to The Block, Trezor is shrinking its wider reseller network, with notified resellers losing authorisation on 1 January 2027. OneKey revoked CryptoBilis, is reviewing sellers operating under questionable legal entities, and is offering free replacements for devices bought through CryptoBilis between 1 March and 13 October 2026. Ledger CEO Pascal Gauthier said the company is reviewing controls on both direct sales and resellers.
Why it matters: the fix being discussed is chain of custody, meaning who handled a device between factory and buyer, not better cryptography.
The honest counterweight
No confirmed Indonesian victims yet. As of 07:30 WIB, 14 October 2026, no public source confirms that devices sold in Indonesia carried the implant or that Indonesian users lost funds. Reporting describes the affected buyers as Southeast Asian, and BleepingComputer describes CryptoBilis as Malaysia-based.
Loss totals are unverified. Every dollar figure in circulation comes from third-party researchers. Ledger has said these numbers have not been fully verified, and the estimates may overlap.
The European cases are not yet linked. Reports of implants in devices bought at MediaMarkt in Germany and at Singapore's airport have not been tied by Ledger to the CryptoBilis incident.
Indonesia crypto self-custody: the local exposure
CryptoBilis had a visible Indonesian footprint. Blockchainmedia.id reported on 11 October 2026 that its website listed PT Crypto Bilis Indonesia, shipped from Jakarta, and ran a Tokopedia store active since May 2022 with more than 700 reviews and more than 2,400 products sold, alongside a Shopee storefront. Those store figures come from a single outlet and could not be independently confirmed.
In the Indonesian-language coverage reviewed for this article, including Liputan6, Telset and Blockchainmedia.id, none quoted a statement from OJK or another Indonesian authority on the incident as of 14 October 2026. Ledger says it is working with "relevant authorities" but has not named any, and it advises affected users to coordinate with law enforcement before opening a device.
For Indonesian holders who bought from CryptoBilis, Ledger's guidance is direct: do not initialise an unused device, and move assets from an activated one to a new device with a freshly generated recovery phrase.
Web3 Week Asia 2026: blockchain event in Jakarta, 11-12 November
Web3 Week Asia takes place on 11-12 November 2026 in Jakarta. It is a two-day event covering markets, regulation, infrastructure and venture investment across Southeast Asia, with four tracks: Investor Meetups, Alpha Callers, Web3 Entrepreneur and Indonesia Crypto Outlook 2026.
An attack that turned a trusted retail channel into the entry point is a practical case for the infrastructure discussion: how custody products reach users who buy through e-commerce, and who is responsible when that channel fails. The organisers say the 2025 edition drew more than 5,000 participants and more than 100 speakers; the 2026 speaker line-up is to be announced.
Frequently asked questions
When and where is Web3 Week Asia 2026?
Web3 Week Asia 2026 takes place on 11-12 November 2026 in Jakarta, Indonesia. It is a two-day crypto and blockchain event covering markets, regulation, infrastructure and venture investment across Southeast Asia.
What did Ledger find in CryptoBilis devices?
Ledger said on 13 October 2026 that its Donjon team confirmed unauthorised LTE implants in signers sold by CryptoBilis. The implant captured the 24-word recovery phrase during setup and sent it over a mobile network using an eSIM.
How much crypto was stolen?
Ledger has not published a figure. On-chain researchers estimate more than US$72 million to US$93.2 million, possibly overlapping.
Were Indonesian users affected?
CryptoBilis sold in Indonesia, but as of 14 October 2026 no public source confirms Indonesian victims or tampered devices sold in Indonesia.
What should CryptoBilis buyers do?
Ledger advises not setting up an unused device, and moving funds from an activated device to a new one with a newly generated recovery phrase.
Sources
CoinDesk, Ledger says spy chip inside CryptoBilis devices transmitted wallet keys over mobile network (13 October 2026): https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network
The Block, Ledger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in Europe (13 October 2026): https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-reseller-units-mediamarkt-suspends-sales-europe-418442
Implant mechanism and Ledger statements: CoinDesk and The Block (13 October 2026), BleepingComputer (12 October 2026). Loss estimates: The Block (9 October 2026), Liputan6 (11 October 2026), CoinDesk (13 October 2026), Indodax Academy (12 October 2026). Tether freeze: CoinDesk (13 October 2026), The Defiant citing MistTrack (9 October 2026). Trezor, OneKey and MediaMarkt Saturn actions: The Block (13 October 2026), cross-checked with Newscord's outlet comparison. Tibane Labs variants and Malaysia base: BleepingComputer (12 October 2026). CryptoBilis Indonesian presence: Blockchainmedia.id (11 October 2026), with reseller status confirmed by The Block and Liputan6.
Methodology: Loss figures are presented as a range from the lowest published estimate (more than US$72 million, tanuki42) to the highest (US$93.2 million, as reported by CoinDesk) and are not summed, because the estimates may cover the same addresses. The 28-day figure is 11 November minus 14 October 2026. The wallet count and the US$10 million Tether freeze are single-sourced and attributed in the text. Claims of implants outside CryptoBilis devices were excluded from the loss range because Ledger has not linked them to this incident.
This article is for information only and is not investment advice.
