Incident Update - Oct 13th, 2026
Ledger is asking resellers and distributors in Southeast Asia and Hong Kong to suspend sales of Ledger devices while the investigation is ongoing. This includes taking products off the shelves.
Specifically the countries are: Indonesia, Singapore, Thailand, Philippines, Vietnam, Malaysia, and Hong Kong.
To be clear, as the investigation continues, the only confirmed incidents remain contained to Southeast Asia. We have not verified a drain linked to a device bought elsewhere.
The investigation is ongoing to determine who tampered with these devices and where in the distribution chain it happened. The Ledger Donjon will analyze the devices it receives, and Ledger Customer Support will provide guidance to users who reach out through our official channel: https://t.co/QzukOZecoY.
We understand this is concerning, and will continue to provide updates from the Ledger Donjon as the investigation progresses. Stay vigilant.
We have no indication that Ledger's infrastructure, systems or services or direct sales channel have been compromised.
Update from Ledger Donjon on the CryptoBilis investigation 🔽
@DonjonLedger is investigating Ledger signers sold by CryptoBilis, a reseller in Southeast Asia, that contained an unauthorized hardware implant. Ledger confirmed this on October 10th for one affected user's signer. All confirmed fund losses tied to the incident disclosed on October 9th involve signers sold through CryptoBilis. We have not verified a drain linked to a signer bought elsewhere. CryptoBilis has confirmed it stopped selling Ledger signers while the investigation continues.
Based on the Donjon's analysis of the attack, the implant sits inside the enclosure and reads the data shown on the screen. During setup, the signer displays the 24-word recovery phrase. When the implant detects these screens, its microcontroller decodes the words and transmits them over LTE using a provisioned eSIM. The implant is a separate component. It does not modify the Secure Element or the Ledger operating system, and it does not alter transactions or signatures.
The Donjon will analyze the signers it receives and will share more as the investigation continues.
We have not confirmed the total number of affected users or the total value lost. Figures circulating online come from third parties and Ledger has not fully verified them. If your funds were drained and you have not contacted us, please do so through Ledger Support so we can include your case. We are also reviewing reports of implants in other signers and locations. We will continue to share information as the investigation progresses. Rest assured the Ledger team is going above and beyond to leave no stone unturned to investigate this situation to the strongest possible outcome.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up and contact Ledger Support. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a signer bought from CryptoBilis. Never enter your recovery phrase into a website, app or form.
If you lost funds or hold a tampered signer, contact Ledger Support at https://t.co/QzukOZdEzq and file a report with local law enforcement. Do not send the signer to anyone before speaking with Ledger Support or local law enforcement. If you lost funds, coordinate with law enforcement before opening the signer. Researchers and others with relevant information can write to [email protected].
If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at https://t.co/Bh9DHQulIv. Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Ledger will never call you, message you directly, or ask for your 24-word recovery phrase. We will update this post when we verify new information.
Following recent supply-chain incidents, we decided to reduce the number of resellers so we can more effectively check those we work with.
Let us be very clear: there is not a single piece of evidence that Trezor devices have been compromised.
This is a preventive step, taken out of an abundance of caution. We also want to thank everyone involved for the cooperation, and for the years of work putting Trezor in people’s hands.
Btw! We videcoded a chrome extension where you can see the price movement and the mempool. Like any true maniac, you are welcome!
https://t.co/A2T31qeOx7
In 1979, a talk show host looked at one of the most influential economists alive and told him, on live television, that capitalism ran on greed.
Milton Friedman had won the Nobel Prize in Economics three years earlier, in 1976, for his work on monetary theory and consumption analysis.
Phil Donahue, host of the highest-rated daytime talk show in America, asked him directly whether the concentration of power and profit under capitalism had ever given him a moment of doubt.
Friedman didn't pause before answering. "Well, first of all, tell me, is there some society you know that doesn't run on greed? You think Russia doesn't run on greed? You think China doesn't run on greed?"
He kept going, arguing that only capitalist societies built on voluntary exchange had ever lifted large numbers of people out of poverty, while every attempt to replace self-interest with central planning had made things worse.
Donahue tried one more angle, asking who would organize a fairer society if not government. Friedman's answer to that question is still being clipped and argued over online more than four decades later.
Their exchange lasted less than two minutes inside a much longer interview about the Great Depression, auto bailouts, and price controls, and it's become one of the most replayed moments in the history of televised economics.
Was Friedman right that every system runs on self-interest whether we admit it or not, or did he dodge the real question about inequality? Say which side you land on in the comments, then watch the full exchange below.
Our third-party e-mail provider has been breached. Please be aware that the email named ‘Critical Security Alert: STM32 Entropy Vulnerability’ is not coming from us, and it’s a phishing attempt. Do not click on any link.
We have taken down the domain, and we are investigating the situation, including how the hackers got access to our legit domain.
🚨BTCPay Server 2.4.4 is out!
A security-focused update in response to ongoing attempts to attack the project.
We recommend all server admins update.
Some changes are breaking, so please read the article before updating. Thank you to everyone helping us protect the community and for bearing with us. 💚
Two days ago, we received an update from our shipping provider, ShipMonk. We're deeply saddened to share the news that the recent data breach affects more customers than originally thought.
Another 67,000 customers from the US who ordered between November 2019 and August 2021 were affected, with their full details (name, email, phone number, shipping address, order number) exposed.
All affected customers have been emailed directly. If you didn’t receive an email, then you are not affected.
Throughout our entire relationship with ShipMonk, we repeatedly requested and received written assurance confirming the deletion of the data, in line with our contract, data policy, and past communications. We are very disappointed that, despite receiving this confirmation, the data was not deleted in their systems.
Trezor systems were not compromised, and your device is secure. But please be alert for fake emails, phone calls, fraudulent letters, and potential risks to physical security.
NEVER share your wallet backup with anyone or type it into a website.
We’re terribly sorry to everyone affected. We take this matter very seriously and are working to ship anonymous delivery ASAP, so you can protect your personal information when placing an order.
For more information, visit our blog: https://t.co/3KnO4LyBKb