Tens of millions of dollars reportedly were drained from wallets within days in October 2026, without the owners approving any transaction. This case study is a useful lens on crypto wallet security. It walks through what is publicly known about the Ledger and CryptoBilis incident, what is still unverified, and how the layers of wallet safety fit together. [1][2]
"How safe is my crypto" is really several questions at once.
What happened
On 13 October 2026, Ledger's Donjon security team confirmed that hardware signers sold through CryptoBilis, a reseller listed as authorised in Indonesia, Malaysia and the Philippines, contained unauthorised LTE implants. According to Ledger, the implants captured the 24-word recovery phrase displayed during device setup and sent it over a cellular connection using an embedded eSIM. [2][3][4]
Ledger says the implants did not modify the device's Secure Element or its operating system, and did not alter transactions. It also warned that tampered devices may still pass its authenticity checks. [3][4]
Most of the thefts reportedly happened on 9 October. Arkham Intelligence attributes about $95.35 million - 1,486 addresses between 7th and 9th October, with roughly $80.6 million taken within 51 minutes on the 9th. [1]
Other researchers give different totals: Specter put losses above $86 million, and Bitquery estimated about $102 million. [2][5] Ledger has not verified any total or the number of affected users. [2][4]
The important detail for readers is what has not been established. How the implants were installed and where in the supply chain it happened remain unclear in public reporting. Ledger says confirmed thefts all involve CryptoBilis devices and that it has no indication its own infrastructure was compromised, while it reviews unconfirmed reports elsewhere. [2][4][5]
Two Meanings of "Drain"
Headlines use "wallet drainer" for very different attacks, and the difference matters.
In this case, the weakness sat below the software: the device itself had been altered before it reached the owner, so the secret that controls the wallet was copied at the moment it was created. Nothing needed to be approved later.
The more common drainer pattern works through approvals. In a 1 July 2026 advisory, the Singapore Police Force described scams in which victims are lured onto malicious links, malware captures credentials, and victims are tricked into approving a "permit signature" that pre-authorises future transfers. The advisory says this can allow transfers without further approval, even when a hardware wallet is used, and that no funds may move immediately, so exposure can go unnoticed. [6]
The point of entry is different, which is why a single piece of advice rarely covers both. Both end the same way, with a wallet emptied.
Layers of Crypto Wallet Security
It helps to separate where trust sits:
- The Device and Seed Phrase: Who made the device, who sold it, and who has ever seen the recovery phrase. The CryptoBilis case sits here.
- The Approvals: What permissions a wallet has granted to sites and contracts, and what a signing prompt actually authorises. The Singapore advisory sits here. [6]
-
The token itself: Whether the contract behind an asset has administrator controls such as pausing transfers or blacklisting addresses.
-
The platform: Where assets are held when they are not in a personal wallet, and what rules the operator must follow.
Most conversations about safety focus on one layer. Losses tend to come from the one nobody was looking at.
What Mirror Ai's Data Adds
Mirror Ai's security tools cover the token and contract layer, not hardware. As at 29 October 2026, its platform threat feed, 30-day recurring-pattern query and high-risk token list (scores of 70 or above, last 30 days) returned no rows. An empty result reflects what the pipeline has scanned, not a clean bill of health, and it says nothing about a device sold through a reseller.
A stored scan of the Tether (USDT) contract on Ethereum, refreshed on 28 and 29 October 2026, shows how the contract layer reads. Mirror Ai rated it "caution" with a risk score of 49 out of 100, flagging a blacklist function, owner-pausable transfers and an upgradeable proxy pattern. Its address security checks did not flag the contract as phishing or malicious. [7]
Those are design features, and they cut both ways. Reports say Tether froze about $10 million in USDT linked to the attacker wallets in this incident, which is a control working as intended for victims. The same control is also a reason an asset's holders depend on its issuer's decisions. [1] A risk flag is a prompt to read the documentation, not a verdict.
Questions Worth Asking
This is general information.
These questions draw on what Ledger, the Singapore Police Force and other sources have published:
-
Where was the device bought, and was it sold by the manufacturer or an authorised reseller?
Ledger's confirmed cases all involve one reseller. [2][4]
Was the recovery phrase ever generated or typed on a device whose origin is uncertain? Ledger's guidance to affected buyers was to treat that phrase as compromised and move assets to a new device with a new phrase. [3][4] -
Does the device pass the manufacturer's inspection guide?
Ledger notes that opening a device can damage it, and recommends backing up the phrase first. [2][4] -
What does a signing prompt authorise, and are old approvals still active?
The Singapore police advisory suggests reviewing and revoking permissions. [6] -
Does the token's contract allow an administrator to pause, mint or blacklist, and has that been disclosed?
If assets sit on a platform, what do its asset-holding and disclosure rules say? In Australia, ASIC's proposed standards for digital asset platforms cover asset-holding, settlement and disclosure. [8]
The Next Steps
Other manufacturers moved on the reseller layer. Trezor said it found no tampered CryptoBilis devices, removed CryptoBilis from its reseller list and is reducing its wider reseller network. OneKey revoked CryptoBilis's authorisation and offered free replacements for devices bought through it between 1 March and mid-October. Retailer MediaMarkt Saturn stopped selling Ledger devices as a precaution after a customer report, although that report was unverified. [2][5]
Reputation and provenance are different things, and provenance is checkable.
FAQ
-
What is a crypto wallet drainer?
The term is used for malicious tools or scams that empty a wallet, usually by tricking an owner into approving a transaction or permission. The Ledger case is different, because the reported cause was a hardware implant. [3][6] -
Was Ledger's own hardware compromised?
Ledger says it has no indication that its own infrastructure, systems or services were compromised, and that confirmed thefts involve devices sold through CryptoBilis. Its investigation is continuing. [2][4] -
Can a hardware wallet still be exposed?
According to the Singapore Police Force, some permit-signature scams can enable transfers without further approval even when a hardware wallet is used, and Ledger says tampered devices can pass authenticity checks. [3][6] -
Can Mirror Ai detect a tampered device?
No. Mirror Ai's scans cover contracts, tokens and addresses, not physical hardware.
Try Mirror Ai
If you want to see contract and security context alongside a token before you place an order, you can try Mirror Ai at https://mirror.glasslane.io/try.
References
-
crypto.news. "CryptoBilis Ledger hack: $95 million stolen, $10 million frozen". 29 October 2026. https://crypto.news/cryptobilis-ledger-drainer-95m-stolen-funds/
-
The Block. "Ledger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in Europe". 13 October 2026 (updated 19 October). https://www.theblock.co/news/business/2026-10-13-ledger-confirms-hardware-implant-cryptobilis-units-mediamarkt-suspends-sales-europe-418442
-
The Record. "Ledger cryptocurrency wallet implant theft". 13 October 2026. https://therecord.media/ledger-cryptocurrency-wallet-implant-theft
Decrypt. "Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain". 13 October 2026. https://decrypt.co/380826/ledger-finds-lte-implant-that-stole-recovery-phrases-in-suspected-86m-drain -
Cointelegraph. "Ledger cellular implants wallets sold CryptoBilis". 13 October 2026. https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis
Singapore Police Force. "Police advisory on cryptocurrency scams involving malicious links". 1 July 2026. https://www.police.gov.sg/Media-Hub/News/2026/07/20260701_police_advisory_on_cryptocurrency_scams_involving_malicious_links -
Mirror Ai. Security profile, Tether USDT contract (Ethereum), cache updated 29 October 2026; threat feed, pattern analysis and high-risk token queries run 29 October 2026. Internal data.
-
ASIC. "26-245MR ASIC consults on implementation of new digital asset laws". 15 October 2026. https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2026-releases/26-245mr-asic-consults-on-implementation-of-new-digital-asset-laws
General information only. This article is education and does not take into account your objectives, financial situation or needs, and is not financial advice.
