Initially thought to be confined to Southeast Asia, the Ledger security breach has expanded. Crypto commentator Fto (@ftosol) alerted XRP holders and the wider cryptocurrency community that the same compromised hardware previously identified at Malaysian reseller CryptoBilis is now appearing at European retail locations.
Because devices equipped with concealed LTE-enabled spy chips have started crossing international borders, the breach affecting Ledger’s supply chain is proving to be much larger than first indicated.
Fto cautioned that waiting for confirmation from the U.S. is dangerous, advising holders to protect their funds by transferring their assets right away.
Ledger will never recover from this.
The entire supply chain is under attack. It’s no longer isolated. It’s EVERYWHERE.
Reports tied it all back to Asia, now the exact same malware is being found at Europe retailers.
If compromised devices are already crossing borders,… https://t.co/5nGcvpz74C pic.twitter.com/BmDJI0xEMg
— Fto (@ftosol) October 12, 2026
The Original Attack
The incident originated at CryptoBilis, a retailer authorized by Ledger that operates in Malaysia, Indonesia, and the Philippines. Perpetrators tampered with Ledger Nano X units physically prior to delivery. A tiny secondary circuit board, equipped with an LTE modem and an eSIM, was tucked inside each device right beneath the display.
During the setup process, as the 24-word recovery seed phrase was displayed, the hidden component recorded and transmitted those words via a cellular network connection. Attackers subsequently used the acquired seed phrases to compromise wallets from afar. Because the authentic secure element chip was left unaltered, Ledger’s native authenticity verification accepted the modified units without flagging them, as only the newly added components were malicious.
According to blockchain analytics company Bitquery, stolen funds have been tracked across six different blockchain networks: TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. Stolen assets now exceed $100 million, affecting more than 320 wallets.
The Supply Chain is Compromised
Fto published a photograph depicting an unsealed Ledger device that clearly reveals an unauthorized secondary circuit board. He remarked that the supply chain is no longer contained and that affected hardware is currently moving across borders.
The Community Reacts
Multiple members of the community have shared their perspectives. One observer pointed out that the physical modification clears Ledger’s Genuine Check because the primary secure chip remains authentic, calling this alarming aspect the primary reason the tampering can only be spotted by physically dismantling the unit.
Another commentator mentioned that Ledger operates a multibillion-dollar business with a heavy emphasis on marketing, implying that the true magnitude of the event might be downplayed and overshadowed by promotional efforts.
What Holders Should Do
Fto directed a straightforward message to asset holders: transfer your funds away from Ledger immediately. Although hardware wallets have traditionally enjoyed immense trust within the crypto ecosystem and remain very secure, this incident has prompted numerous investors to re-evaluate their storage choices. In Fto’s assessment, “Ledger will never recover from this.”