Last updated: Bitcoin data through
The Ledger Tampering
May Be Bigger Than We Know.
The known theft may be only part of the story. We found additional transfers resembling it, involving roughly 184 BTC across 742 addresses. Could more devices have been tampered with? Owners who rarely check their cold wallets may not yet know their funds are gone.
Ledger confirmed a hardware implant in an affected customer’s device. These additional addresses are separate from the 326 known affected addresses. The matching transfers occurred over several months.
These additional matches are leads for review, not confirmed thefts. We welcome collaboration to establish whether the transfers were authorized.
A device can appear genuine and still expose a wallet.
Ledger makes hardware wallets: devices that hold the keys used to authorize cryptocurrency transfers.
On 10 October 2026, Ledger reported an unauthorized implant in a device from an affected CryptoBilis customer. CryptoBilis sold hardware wallets.
Ledger’s statement confirmed that “one of the impacted users’ devices contained an unauthorized hardware implant.”
The recovery words are enough to spend the funds.
Recovery words recreate a wallet’s spending keys. Anyone who captures them can spend its Bitcoin without the original device.
The hardware examination describes an added board that reads the display connection and sends recovery words through a cellular connection.
Ledger’s Genuine Check verifies the original security chip. Ledger’s threat model explains that a spying implant can escape that check when the chip remains intact.
A new device can expose an old wallet.
Restoring an existing wallet uses the same recovery words. Doing this on a modified device could expose Bitcoin stored years earlier.
This is a possible explanation, not an established cause of the additional matches. We lack purchase and restoration records connecting those addresses to particular devices.
The theft continued after the first public warning.
A wallet can use many Bitcoin addresses. These records count addresses, rather than individual owners.
The known theft emptied 326 Bitcoin addresses into four receiving addresses. Those receivers collected 220.57 BTC after fees.
The first theft transfers arrived on 7 October. Ledger warned buyers on 9 October; a fourth receiver collected from 47 source addresses the following day.
The table places the theft transfers, Ledger’s first warning, later movements, and recorded balances in time order.
Scroll across to follow all four receiving addresses →
| Time (UTC) | Receiver 1View address ↗76 source addressesStolen BTC received92.50620930 BTC | Receiver 2View address ↗46 source addressesStolen BTC received111.28199071 BTC | Receiver 3View address ↗157 source addressesStolen BTC received9.64525039 BTC | Receiver 4View address ↗47 source addressesStolen BTC received7.13264093 BTC |
|---|---|---|---|---|
| Block 970351 | 8 theft transfers. 0.09509553 BTC received. | |||
| Block 970371to 9704067 blocks with activity | 21 theft transfers. 0.75621588 BTC received. | |||
| Block 970416to 97051818 blocks with activity | 108 theft transfers. 6.55928085 BTC received. | |||
| Pending transfers observed | mempool.space records 65 pending theft transfers. | mempool.space records 46 pending theft transfers. | ||
| Block 970590 | 65 theft transfers. 91.97475361 BTC received. | 46 theft transfers. 111.28199071 BTC received. | 1 theft transfer. 0.00026830 BTC received. | |
| Block 970591 | 11 theft transfers. 0.53145569 BTC received. | |||
| Ledger notice | Ledger reports customer losses and asks CryptoBilis to pause sales and shipments. | |||
| Block 970646to 9706603 blocks with activity | 17 theft transfers. 2.17222946 BTC received. | |||
| Block 970669 | 2 theft transfers. 0.06216037 BTC received. | |||
| Block 970696 | 4.69052803 BTC sent to other addresses.Fee: 0.00019440 BTC.0.31714337 BTC returned to the same address in this transaction.Transaction | |||
| Block 970697 | 4.95031636 BTC sent to other addresses.Fee: 0.00421160 BTC.Transaction | |||
| Original balance snapshotBlock 970707 | The balance is 92.50620930 BTC. | The balance is 111.28199071 BTC. | The balance is 0.00000000 BTC. | The balance is 0.00000000 BTC. |
| Block 970748 | 0.00000583 BTC received after the initial theft transfers. Transaction | |||
| Block 970750 | 0.00000583 BTC received after the initial theft transfers. Transaction | |||
| Block 970751 | 0.00000583 BTC received after the initial theft transfers. Transaction | |||
| Block 970777to 9708259 blocks with activity | 42 theft transfers. 7.06036704 BTC received. | |||
| Block 970846 | 5 theft transfers. 0.07227389 BTC received. | |||
| Block 970868 | 3.92138248 BTC sent to other addresses.Fee: 0.00005640 BTC.1.52125712 BTC returned to the same address in this transaction.Transaction | |||
| Block 970870 | 3.20988845 BTC sent to other addresses.Fee: 0.00131360 BTC.Transaction | |||
| Final investigation cutoffBlock 970943 | The balance is 92.50622679 BTC.Includes 0.00001749 BTC received after the initial theft transfers. | The balance is 111.28199071 BTC. | The balance is 0.00000000 BTC. | The balance is 0.00000000 BTC. |
| Investigation cutoffs | Original balance snapshotBlock 970707 Final investigation cutoffBlock 970943 | Original balance snapshotBlock 970707 Final investigation cutoffBlock 970943 | Original balance snapshotBlock 970707 Final investigation cutoffBlock 970943 | Original balance snapshotBlock 970707 Final investigation cutoffBlock 970943 |
Each activity row covers one block or the block range shown. Pending observations are separate from confirmed transfers.
Transaction records and counting notes
The table covers 333 confirmed address-transaction records, including later deposits and payments. This differs from the 326 original theft transfers.
The balances agree with the complete transaction records through block 970943. Download transactions (CSV) ↗.
Some funds stayed. Others moved toward a shared destination.
The two larger receivers had not spent Bitcoin by the 11 October cutoff. The two smaller receivers moved their funds onward.
No onward spending recorded
No onward spending recorded
Moved onward · later reached a shared recipient
Moved onward · later reached a shared recipient
The bars show amounts originally stolen, not current balances. Later deposits are recorded separately in the timeline.
Funds from the third and fourth receivers later reached the same recipient. That links the routes, but does not establish who controls the recipient.
One traced branch reached a public swap service. A service deposit shows where funds went; the service’s own wallet activity does not become attacker activity.
A small share of addresses held most of the value. Addresses are not people; this measurement covers the known case only.
Inspect the four known receiving addresses
Where else had Bitcoin moved in the same way?
We retain Bitcoin’s block and transaction records and connect each spend to the funds it used.
That history lets us compare balances, previous spending, quiet periods, earlier payments, and later destinations.
A source address is where the BTC left; a receiving address is where it arrived. Each selected transfer spent its source address’s full Bitcoin balance.
We reconstructed those transfers and examined the earlier activity of the addresses involved. We compared how the payments were built, beyond simply emptying an address.
Moving a full balance can be legitimate. We tested competing explanations and checked whether the findings held when assumptions changed.
We searched the recorded history for activity matching the known case, retaining the supporting transactions for review.
This retrospective check found the known reference transfers. It does not measure how often unrelated activity matches; that rate has not been independently established.
Independent comparison with legitimate wallet activity would help test the additional findings. Their connection to a device compromise remains unestablished.
Our state-engine article explains how we build the Bitcoin history used here.
About 184 BTC moved in transfers worth checking.
The additional 742 addresses are separate from the 326 known affected addresses. Their matching transfers moved 184.01 BTC after fees.
Additional matches
Over several months. Transfers to review. Independent validation is welcome.
Known theft
October 2026. The established case used to begin the search.
We count addresses; the number of people or devices is unknown.
Looking at the receiving side shows where those individual movements came together.
Additional matches
Known theft
The additional receivers are separate from the four known theft receivers. The drawing illustrates the direction; it does not show individual transfers or owners.
Inspect the exact totals and counting rules
The known theft and the additional matches
BTC received excludes transaction fees. Combined totals include both groups without changing the status of the additional matches.
| Case type | Source addresses | BTC received |
|---|---|---|
| Additional matches · leads for review | 742 | 184.01213479 |
| Known theft | 326 | 220.56609133 |
| Combined | 1068 | 404.57822612 |
Many addresses had been quiet for at least a year.
732 of the 742 additional addresses had never spent BTC before the matching transfer. 463 also had no BTC activity for at least a year.
Someone keeping Bitcoin untouched for years may rarely check the balance. A transfer could go unnoticed until the owner next looks.
The quiet-period counts are nested: the one-year group is included in every shorter threshold. Do not add these bars. Bitcoin activity does not show device use or owner awareness.
An earlier withdrawal can give an exchange a route back to a customer.
An earlier exchange withdrawal can connect a Bitcoin address to a private account record. That gives a service team a starting point for verification.
TrackBTC identifies the earlier payment. The service checks its own records and, where appropriate, asks the customer whether the later transfer was expected.
Trace the earlier payment
TrackBTC identifies a payment from an exchange or another service to the address being reviewed.
Bitcoin transaction historyMatch the withdrawal
The service checks whether its records connect that payment to a customer account.
The service’s private recordsAsk the customer privately
Was the later transfer expected? Does the customer need help understanding what happened?
The service’s established contact channels
The earlier payment alone does not establish current ownership or whether the later transfer was authorized.
Additional matches
227 of 742 addresses30.6% had received an earlier payment from a service we could identify.
Known theft
174 of 326 addresses53.4% had received an earlier payment from a service we could identify.
Service identities are withheld. An earlier payment does not establish current ownership or whether a later transfer was authorized.
An address can receive Bitcoin from more than one service. Each total counts an address once within its group; customer numbers remain unknown.
Inspect the broad funding totals
| Research population | Distinct source addresses |
|---|---|
| Additional matches | 227 |
| Known theft | 174 |
| Combined | 401 |
An address can receive Bitcoin from more than one service. These totals count each address once within its population.
The next answers need more than Bitcoin records.
The search identifies transfers to examine. Confirming an unauthorized transfer and establishing its cause require different evidence.
Was the transfer authorized?
Service teams can use withdrawal records and private customer confirmation to check the relevant transfers.
After confirming who controlled the wallet, the team can ask whether they authorized the later transfer. The cause remains a separate question.
Could ordinary wallet use look the same?
Independent researchers can compare legitimate wallet activity with the matching transfers and test alternative explanations.
This would help establish how often unrelated activity matches and which findings merit closer review.
Was a modified device involved?
Device examinations, purchase records, and wallet-restoration dates could connect an unauthorized transfer to a specific compromise.
Distribution records could help identify a shared supply route. The current Bitcoin evidence does not establish which devices or stock were affected.
Contribute to the research.
We welcome evidence, independent validation, and competing explanations. Contact TrackBTC Research to agree which question to examine and how to review sensitive records privately.
Initial actionable disclosure is free. Research collaboration is voluntary and does not require a subscription or pilot.
Joint publication or acknowledgment can follow verified contributions, with permission.
Publication boundary and source record.
Individual case records and funding-service identities remain private. Relevant records can be reviewed through coordinated collaboration.
We withhold the additional addresses, transaction IDs, individual amounts, and supporting files. The known receiving addresses and their transaction table remain available above.
We recorded hashes of the report and evidence on Ethereum. View the dated record ↗. It establishes a dated commitment to those files, rather than certifying the findings.
Bitcoin evidence ends at block 970943 on 11 October 2026. Earlier funding-service names were reviewed on 14 October.