Imagine doing everything right.
You skip the random Instagram vendor. You buy your Ledger from a shop that Ledger itself lists as an authorized reseller. The box arrives in perfect shrink wrap. You set it up, write your 24 words on paper and put them somewhere safe.
Your money still disappears.
That is what reportedly happened to hundreds of people this week. By one onchain trace, about $93 million left more than 300 wallets across five blockchains. I went through the attacker wallets myself, and this is the story as far as the chain and the public record can tell it.
The shop
The shop is called CryptoBilis. It started in Kuala Lumpur in 2020 and sold Ledger wallets to customers in Malaysia, Indonesia and the Philippines. Ledger listed it as an official reseller.
Nothing about it looked wrong. Real devices, years of normal customers, the kind of shop people point to when they tell you to buy "from an authorized seller."
The board behind the screen
On 8 October, Mark Karpelès (yes, the former Mt. Gox CEO) posted photos of a Ledger he had cracked open. His came from Malaysia, in flawless shrink wrap.
Where the padding behind the screen should be, there was a tiny extra circuit board: an LTE modem, an antenna and an eSIM.
Think about what that means. The Ledger's secure chip is still the real one. But a second board sits right behind the screen, the exact place your 24 words appear during setup. If that theory holds, your seed phrase can leave the device the moment you look at it, over mobile data, with no Wi-Fi and no computer involved.
His post went viral, with more than 170,000 views. But the part almost nobody talked about is this: one of the Bitcoin addresses investigators later flagged was already quietly draining wallets on 7 October, about 17 hours before his post. The robbery had already started.
The sweep
At 05:54 UTC on 9 October, the thief stopped being quiet.
In a single Bitcoin block, 203 BTC landed in two addresses, pulled from 111 different wallets at the same moment. You do not phish 111 people at once. You already hold their keys, and you press one button.
The same morning it happened on Ethereum and Tron. Three ETH addresses took in more than 100 transfers within hours. The USDT on Tron was cut into round chunks of $500,000 to $10 million and pushed onward fast.
What Ledger said
About seven and a half hours after the big sweep, Ledger responded through its support account. It said it is investigating and has told CryptoBilis to pause all sales. If you bought from them in the last 90 days, don't set the device up. If you already did, move your funds to a new seed on a new device.
Ledger also said nobody who bought directly from Ledger has reported losses, and that its own systems were not hacked.
Where the money is now
The money is still moving. Tether has reportedly frozen part of the USDT, and some of the ETH has reportedly gone through Tornado Cash.
But when I checked the wallets on the morning of 10 October, about 204 BTC and roughly 2,400 ETH (around $6 million) were still sitting there. Waiting.
Who did it?
The chain shows wallets, not faces. Reports say the shop quietly changed owners this year, but nobody has officially tied that to the bugged devices, and Ledger has not said exactly how the attack worked.
The honest answer for now is that we don't know.
Why this matters in Nigeria
I checked Ledger's reseller page. In all of Africa, it lists only one country: South Africa. There is no authorized Ledger reseller in Nigeria.
So unless you ordered from Ledger directly, the wallet in your drawer came through someone who is not on that list. That is not an accusation against anyone. It is just the point of this story: if an authorized shop can ship bugged devices, any middleman can.
What to do
Buy hardware wallets only from the maker's own website, shipped straight to you.
If you bought from anyone else, check your device with Ledger's official guide, then move your funds to a fresh seed phrase on a device you bought direct.
Never use a wallet that arrives with the 24 words already written down, or with a "recovery card" filled in. A real wallet always makes you create the seed yourself.
The lesson
"Authorized" tells you who a brand trusted at some point. It does not tell you who is handling the box today.
If you know someone who didn't buy their wallet direct, send this to them.
I first posted this as a thread on X: https://x.com/The_Real_EJC/status/2108904125790650539 . Balances were read from public block explorers on 10 October 2026 and will have changed since.