Observed Signal · Oct 10, 2026 · Security Breach · Source: Trending Topics (DACH/CEE Innovation & Tech) · Impact: 2/5 · Sentiment: Negative
Ledger Investigates Tampered Wallets via Reseller CryptoBilis
Ledger, the French hardware wallet manufacturer, has confirmed that a customer's device contained an unauthorized hardware implant, following a series of thefts in Southeast Asia. The affected devices were sold through CryptoBilis, an official Ledger distributor for Indonesia, Malaysia, and the Philippines. The implant, reportedly a second circuit board with a microcontroller and cellular hardware, can intercept recovery phrases during setup and transmit them remotely. Blockchain analytics firms estimate losses between $71.5 million and $92.9 million across hundreds of wallets on Bitcoin, Ethereum, and Tron. Ledger has demanded CryptoBilis halt all sales and deliveries, advising customers who purchased in the last 90 days to transfer funds to new devices with fresh recovery phrases. Ledger states its own infrastructure was not compromised and is reviewing reseller controls. CryptoBilis has suspended all hardware wallet sales pending investigation. The incident adds to Ledger's history of security issues, including a 2020 data leak and a 2023 Connect-Kit attack.
Not directly AdTech, but highlights security risks in crypto infrastructure, which can indirectly affect digital advertising payment ecosystems.
Track Global-e Signals & Market Shifts in Real-Time
Polaris7 autonomous intelligence agents track regulatory filings, primary sources, executive changes, and deal flow 24/7. Create your Polaris7 workspace to monitor these entities.
Key Takeaways & Evidence Grounding
- Ledger confirmed an unauthorized hardware implant in a customer's device, linked to thefts in Southeast Asia.
- Affected devices were sold through CryptoBilis, an official Ledger distributor for Indonesia, Malaysia, and the Philippines.
- Blockchain analytics firms estimate losses between $71.5 million and $92.9 million across hundreds of wallets on Bitcoin, Ethereum, and Tron.
- CryptoBilis has suspended all hardware wallet sales pending investigation.
- Ledger's own systems and direct sales channels were not compromised.
Connected Companies & Entities
1 Entity mapped“Earlier this year, a data leak at payment service provider Global-e exposed names and contact details of Ledger buyers.”
Ontology Mapping & Concepts
Related Market Signals & Shifts
Recent verified developments and strategic activity across this market segment.
Trezor warns of phishing after Brevo email provider breach
Hardware crypto wallet maker Trezor has warned customers of a second data breach affecting its ecosystem in as many months. A cyberattack on Brevo, a marketing technology company used by Trezor for email newsletters, allowed hackers to send approximately 347,000 phishing emails to Trezor customers. The phishing emails contained a malicious link that, when clicked, downloaded an app requesting the victim's wallet backup password, which could be used to steal cryptocurrency funds irreversibly. Brevo reported that hackers accessed 138 accounts due to improperly scoped permissions. Trezor emphasized that its own products and account systems were not compromised. This incident follows a previous breach at shipping partner ShipMonk that exposed personal data of over 81,000 customers, heightening risks of targeted physical attacks. Trezor is reevaluating vendor relationships and warns that email addresses may be used for future phishing attempts.
Binance suspends withdrawals after suspected multi-billion hack
Binance suffered the largest cryptocurrency theft in history on October 29, 2026, losing around $6.3 billion from hot wallets across ten blockchains. North Korean hackers, using a months-long social engineering scheme with fake recruiter profiles, tricked an employee into downloading malicious software, compromising two other engineers. The exchange covered 95-98% of stolen assets from reserves and SAFU, allocating $6.34 billion, with CEO Richard Teng confirming ongoing buybacks. Customers withdrew $3.6 billion (2.1% of assets), which Binance disputed from DefiLlama's higher figures. Industry cooperation helped contain the breach: Tether, Circle, and Ripple froze about $3 billion, and Coinbase blocked transfers. Bitcoin fell 4.8% initially but recovered to over $78,000. Analysts predict consolidation and custody/trading separation, benefiting independent custodians. Binance admitted the attack 'should not have happened' and implemented security improvements.
Keystone and Foundation Hardware Wallets Hacked
Hardware wallet makers Foundation and Keystone have both suffered data breaches, compromising customer data but not directly stealing cryptocurrencies. At Foundation, attackers exploited compromised Cloudflare API keys to send phishing emails from the company's own domains, potentially exposing customer mailing addresses and phone numbers. At Keystone, a flaw in a third-party monitoring tool allowed attackers to access nearly 26,000 customer records from 2024-2026, including names, contact details, and order information. Keystone is destroying over 18,800 wallets because the device verification key was also compromised. Both companies confirm that devices, payment data, seed phrases, and private keys remain safe. These incidents are part of a year marked by hardware wallet security issues, with Ledger and Coldcard also facing breaches. The primary risk is phishing, as attackers can use stolen personal data to craft convincing emails.
Receive all future signals for Global-e & competitors in your briefing
Never miss material M&A deals, leadership changes, account wins, or product rollouts. Polaris7 monitors 20,000+ primary sources 24/7, delivering verified telemetry directly into your executive briefing.