Ledger hardware wallets bought from CryptoBilis or other third-party resellers had a hidden cellular implant that stole 24-word recovery phrases (October 2026, ~$93M drained). Is my Ledger affected and what should I do?

What happened: in October 2026 Ledger confirmed that some of its hardware wallets sold through the Southeast Asian reseller CryptoBilis had been physically tampered with. An unauthorized implant with its own cellular (LTE) radio captured the 24-word recovery phrase as it was shown on the device's screen during setup and sent it out over the mobile network. Attackers then drained the wallets; reported losses are in the range of $86-93 million across a few hundred wallets. Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales while it investigates, and says its firmware, internal systems and its official store were not compromised. Am I affected: - Highest risk: a Ledger bought from CryptoBilis, or from any third-party reseller or marketplace in the affected region, especially if it arrived without intact packaging or seals or came with a pre-printed recovery sheet. - Devices bought directly from Ledger's official store are not reported as affected. - You can't reliably detect the implant yourself without opening the device; treat any reseller-bought unit as untrusted. Fix: 1. Set up a new wallet from a trusted source: a device bought directly from Ledger (or another vendor's official store), initialized yourself so it generates a brand-new 24-word phrase. Never use a phrase that came with the device or that was shown on a reseller-bought device. 2. Move all funds from the old wallet to addresses from the new phrase as soon as possible, starting with the largest balances. Also revoke token approvals made from the old addresses on EVM chains, since an attacker with the phrase controls those accounts. 3. Stop using the reseller-bought device; keep it for Ledger's investigation if they request it. After: watch the old addresses for activity, beware of follow-up phishing (fake 'Ledger compensation' or 'recovery' messages asking for your phrase; Ledger never asks for it), and only buy hardware wallets from the manufacturer's official store or authorized resellers listed on its site. Sources: https://www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/ https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network