The Ledger hack was supposed to be contained to Southeast Asia. Crypto commentator Fto (@ftosol) raised the alarm for XRP holders and the broader crypto community, reporting that the same compromised hardware found in devices sold through Malaysian reseller CryptoBilis is now surfacing at retailers in Europe.
Devices carrying hidden LTE-enabled spy chips have begun crossing borders, and the attack on Ledger’s supply chain appears far larger than initially reported.
Fto warned that waiting for a U.S. confirmation is reckless and urged holders to secure their positions by moving their assets immediately.
Ledger will never recover from this.
The entire supply chain is under attack. It’s no longer isolated. It’s EVERYWHERE.
Reports tied it all back to Asia, now the exact same malware is being found at Europe retailers.
If compromised devices are already crossing borders,… https://t.co/5nGcvpz74C pic.twitter.com/BmDJI0xEMg
— Fto (@ftosol) October 12, 2026
The Original Attack
The hack began with CryptoBilis, a Ledger-authorized reseller serving Malaysia, Indonesia, and the Philippines. Attackers physically modified Ledger Nano X devices before they reached buyers. They fitted a small secondary circuit board inside each unit, hidden beneath the screen. The board carried an LTE modem and an eSIM.
When a user set up the device, the 24-word seed phrase appeared on screen. The implant captured those words and transmitted them over a mobile data connection. The attacker then used the stolen seed phrases to access wallets remotely. Ledger’s own authenticity check passed these devices because the original secure chip remained untouched. Only the added hardware was malicious.
Blockchain intelligence firm Bitquery traced losses across six chains: TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. The total is now more than $100 million taken from over 320 wallets.
The Supply Chain is Compromised
Fto shared an image showing an opened Ledger device with a clearly visible secondary board installed where there should be none. He stated the supply chain is “no longer isolated,” and that compromised devices are “already crossing borders.”
The Community Reacts
Several community voices weighed in. One noted that the implant passes Ledger’s Genuine Check because the original secure chip is real. He described this as the scariest part because physically opening the device is the only way to detect it.
Another observed that Ledger runs a multibillion-dollar operation where marketing dominates. This suggests the full scale of this situation may get less attention than it deserves as it gets suppressed under Ledger’s marketing.
What Holders Should Do
Fto’s message to holders is clear: move assets off Ledger now. Hardware wallets used to be highly trusted in the crypto space. While they are still highly secure, this event has caused many investors to reassess their positions. According to Fto, “Ledger will never recover from this.”
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
