Ledger Implant Scare: What XRP Holders Should Check Now

Ledger, the hardware wallet maker, confirmed in October 2026 that at least one device sold by its authorized reseller CryptoBilis contained a hidden hardware implant that copied the recovery phrase during setup. Trackers estimate $86 million to $93 million left wallets tied to the reseller’s buyers. Ledger says it has no indication its own systems were compromised.

Many XRP holders moved their coins off exchanges because self-custody felt safer. This story raises an uncomfortable question for them: what if the device itself was the weak point? The video’s answer is that holding your own keys still works, but only if the whole setup is right, starting with where the device came from. The same week, the XRP Ledger switched on a feature called permission delegation, which the video also covers.

What happened with the Ledger reseller?

Ledger began investigating losses linked to CryptoBilis on Friday, October 9, 2026. CryptoBilis is an authorized reseller based in Malaysia that also sells in Indonesia and the Philippines. Ledger said it was looking into reports of lost funds from people who bought devices from the reseller, and it asked CryptoBilis to pause all sales and shipments of its devices.

Ledger acted about an hour after on-chain investigator Specter estimated the losses at more than $86 million. Other counts have since gone past $90 million. CoinDesk reports an estimated $86 million to $93 million taken from more than 300 wallets. As of Ledger’s October 13 update, the company had not confirmed a total.

Specter’s breakdown puts about $42 million in Ethereum, $17.6 million in Bitcoin and $16.5 million in Tether’s USDT stablecoin. The video also lists the Tron network. According to the video, trackers have not shown any XRP among the coins taken. The same checks still apply to anyone holding XRP on a hardware wallet.

On Saturday, October 10, 2026, Ledger said one of the affected users’ devices contained an “unauthorized hardware implant.” An implant is an extra circuit that someone has hidden inside a device.

How did the hardware implant steal recovery words?

According to Ledger’s Donjon security team, the implant reads the 24-word recovery phrase off the device’s screen while the owner sets it up. It then sends the phrase out over LTE, a mobile data connection, using an eSIM. Donjon gave these findings on October 13. The recovery phrase is the master backup for a wallet, so anyone who has it can move the funds. Ledger said the device’s secure chip itself was not modified.

This matches what the video reported before Ledger’s findings came out. The video’s account came from people who said they had taken tampered devices apart. The video also cites one person who said the box looked untouched. Bullrunners has not been able to confirm that.

If those reports are accurate, the affected owners did what they were told. They bought from a reseller on Ledger’s own list and wrote down their words. Meanwhile, a hidden part copied those words during setup.

The video plays a clip of Ledger’s chief technology officer describing security as a chain that is “as secure as the weakest link.” On Ledger’s findings so far, the weak link was not the secure chip Ledger is known for. It was somewhere on the box’s route to the buyer. Ledger has not confirmed how or where the tampering happened. It has told distributors to buy only through authorized channels, and it has banned the restocking of returned products.

What did Ledger’s updates say?

Ledger says it has “no indication that Ledger’s security infrastructure, systems, or services have been compromised.” That line came in a reply from Ledger’s main @Ledger account on X. Later versions added “or direct sales channel.” The video points out that this line was largely missing from the wave of posts claiming Ledger had been hacked and self-custody was finished.

Ledger also gave direct instructions to affected buyers:

• Anyone who bought from that reseller in the last 90 days should not set the device up at all.
• Anyone who already set one up should consider moving assets to a new Ledger with a new seed.

A new seed means a brand new set of recovery words. Ledger is not telling those buyers to update their device. It is telling them to treat the old words as if someone might already have them.

In its 72-hour update on October 11, Ledger said it was working with the authorities. CryptoBilis has stopped selling all hardware wallets until the investigation is finished. According to the video, Ledger also said it is working on improving its anti-tampering measures.

The story has since grown beyond one reseller. MediaMarkt Saturn stopped selling Ledger devices in Europe after a customer in Germany reported a tampered unit. Ledger says it is reviewing reports of implants in other devices and locations.

The video stresses reading Ledger’s statements at the source. Ledger has posted through its main @Ledger account and its support account, ledger_support. Check the exact account name before trusting any post.

Is moving everything back to an exchange safer?

The video argues it is not, and it uses Celsius as the example. Celsius was a crypto app that paid interest and held coins for its customers. On June 12, 2022, it paused every withdrawal. According to the video, most customers’ money stayed locked for well over a year. Larger payouts only began when Celsius came out of bankruptcy at the end of January 2024.

The video also plays an earlier interview clip of Ledger CEO Pascal Gauthier. In it, he says exchanges are useful for trading but people “should never leave your coins on an exchange,” because failures like FTX “will keep on happening.” The video agrees. In its view, piling coins back onto a platform that holds the keys swaps one risk for another.

Self-custody has its own failure mode, too. The video describes Joe Grand as a hardware hacker who is hired to break into wallets when owners lock themselves out. It also mentions Stefan Thomas, Ripple’s former chief technology officer, who held more than 7,000 bitcoin on an encrypted drive behind a password he had forgotten. The video says the Today Show covered his story in 2021. In both cases, the video argues, the problem was the setup, not the idea of holding your own keys.

What is XRP Ledger permission delegation?

Permission delegation is an XRP Ledger feature that went live on October 8, 2026. It lets your account allow another account to do a few set jobs, such as payments, without ever getting your master key. According to the video, you can switch the permission off whenever you want. The XRP Ledger is a separate network and has nothing to do with Ledger the company.

The idea builds on an older feature called regular keys. In the video, XRPL Commons, which teaches developers on the ledger, explains how regular keys work. A regular key pair lets you avoid exposing your master key in day-to-day use. You can rotate or cancel it if you think it may be compromised.

The video is clear about the limits. Delegation would not have saved anyone whose recovery words were already copied, because those words are the master key. What it does offer XRP holders is a built-in way to keep the master key locked away, with everyday jobs handled by something they can cancel. That only works once the wallets they use support it.

Checks to run on your own setup

The video offers a short set of checks any holder can do:

1. Where did your device come from? Straight from the maker’s own shop, or through a reseller or marketplace? The video says this matters most. Even a listed reseller is not a guarantee, since CryptoBilis was on Ledger’s own list.
2. Did it create brand new words? The first time you switched it on, it should have generated new recovery words on its own screen, with nothing filled in already. The video’s advice is not to put funds on any device that came with words pre-filled. A tampered device can still pass this check. The implant Ledger described copied words the device itself generated, which is why the first question carries more weight.
3. Have your words ever touched a screen or camera? According to the video, your recovery words should never have been typed into a phone or computer or photographed.
4. If your XRP is on an exchange, how do you log in? The video notes that if you log in with an email and password, the exchange usually holds the keys, not you.

Some holders are unsure about a device that did not come straight from the maker. For them, the video’s view is that a new device from the maker’s own shop, set up with new words, is the safer option.

The video ends with decisions to settle while things are calm. One is where your XRP actually sits and how that setup started. Another is under what conditions you would move it onto or off a device. Deciding in advance avoids deciding at midnight based on whichever headline is loudest.

What to watch next

Ledger says its investigation is ongoing, and it is now reviewing reports from beyond the original reseller. Watch for three things:

• Whether Ledger confirms how and where the tampering happened.
• Whether more retailers pause sales, as MediaMarkt Saturn did in Europe.
• What Ledger’s anti-tampering changes involve.

Read those updates on Ledger’s own @Ledger and ledger_support accounts rather than reposts. Tracker estimates may still change, and Ledger has not confirmed a loss figure.

On the XRP Ledger side, check whether the wallet you use supports permission delegation before relying on it. Note one current caveat. Official XRPL guidance says not to delegate the PaymentBurn permission until a separate fix, called fixCleanup3_4_0, goes live. At last report, that fix had not gathered enough validator votes.