Nano

The Ledger hack was supposed to be contained to Southeast Asia. Crypto commentator Fto (@ftosol) raised the alarm for XRP holders and the broader crypto community, reporting that the same compromised hardware found in devices sold through Malaysian reseller CryptoBilis is now surfacing at retailers in Europe.
Devices carrying hidden LTE-enabled spy chips have begun crossing borders, and the attack on Ledger’s supply chain appears far larger than initially reported.
Fto warned that waiting for a U.S. confirmation is reckless and <a href="https://timestabloid.com/dom-kwok-to-xrp-army-how-to-ensure-never-to-get-hacked/" rel="noopener noreferrer nofollow">urged holders to secure their positions</a> by moving their assets immediately.
<blockquote class="twitter-tweet">
 Ledger will never recover from this.
 The entire supply chain is under attack. It’s no longer isolated. It’s EVERYWHERE.
 Reports tied it all back to Asia, now the exact same malware is being found at Europe retailers.
 If compromised devices are already crossing borders,… <a href="https://t.co/5nGcvpz74C" rel="noopener noreferrer nofollow">https://t.co/5nGcvpz74C</a><a href="https://t.co/BmDJI0xEMg" rel="noopener noreferrer nofollow">pic.twitter.com/BmDJI0xEMg</a>
 — Fto (@ftosol) <a href="https://x.com/ftosol/status/2109675418852737327?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">October 12, 2026</a>
</blockquote>
<h2 id="strong-the-original-attack-strong">The Original Attack</h2>
The hack began with CryptoBilis, a Ledger-authorized reseller serving Malaysia, Indonesia, and the Philippines. Attackers <a href="https://timestabloid.com/update-for-xrp-holders-how-91-million-was-drained-from-ledger-wallets/" rel="noopener noreferrer nofollow">physically modified Ledger Nano X devices before they reached buyers</a>. They fitted a small secondary circuit board inside each unit, hidden beneath the screen. The board carried an LTE modem and an eSIM.
When a user set up the device, the 24-word seed phrase appeared on screen. The implant captured those words and transmitted them over a mobile data connection. The attacker then <a href="https://timestabloid.com/how-i-lost-all-my-xrp-by-doing-this-with-my-seed-phrase/" rel="noopener noreferrer nofollow">used the stolen seed phrases</a> to access wallets remotely. Ledger’s own authenticity check passed these devices because the original secure chip remained untouched. Only the added hardware was malicious.
Blockchain intelligence firm Bitquery traced losses across six chains: TRON, Bitcoin, Ethereum, BNB Chain, Polygon, and Solana. The total is now more than $100 million taken from over 320 wallets.
<h2 id="strong-the-supply-chain-is-compromised-strong">The Supply Chain is Compromised</h2>
Fto shared an image showing an opened Ledger device with a clearly visible secondary board installed where there should be none. He stated the supply chain is “no longer isolated,” and that compromised devices are “already crossing borders.”
<h2 id="strong-the-community-reacts-strong">The Community Reacts</h2>
Several community voices weighed in. One <a href="https://x.com/banbannard/status/2109684914593644591" rel="noopener noreferrer nofollow">noted</a> that the implant passes Ledger’s Genuine Check because the original secure chip is real. He described this as the scariest part because physically opening the device is the only way to detect it.
Another <a href="https://x.com/r4nk0X/status/2109677418839711872" rel="noopener noreferrer nofollow">observed</a> that Ledger runs a multibillion-dollar operation where marketing dominates. This suggests the full scale of this situation may get less attention than it deserves as it gets suppressed under Ledger’s marketing.
<h2 id="strong-what-holders-should-do-strong">What Holders Should Do</h2>
Fto’s message to holders is clear: move assets off Ledger now. Hardware wallets used to be <a href="https://timestabloid.com/7-best-cryptocurrency-exchanges-integrated-with-trezor-hardware-wallet-2025/" rel="noopener noreferrer nofollow">highly trusted in the crypto space</a>. While they are still highly secure, this event has caused many investors to reassess their positions. According to Fto, “Ledger will never recover from this.”
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on <a href="https://x.com/TimesTabloid1" rel="noopener noreferrer nofollow">X</a>, <a href="https://www.facebook.com/timestabloid/" rel="noopener noreferrer nofollow">Facebook</a>, <a href="https://t.me/markettabloid" rel="noopener noreferrer nofollow">Telegram</a>, and &nbsp;<a href="https://news.google.com/publications/CAAqLAgKIiZDQklTRmdnTWFoSUtFSFJwYldWemRHRmliRzlwWkM1amIyMG9BQVAB?hl=en-US&amp;gl=US&amp;ceid=US%3Aen" rel="noopener noreferrer nofollow">Google News</a>
The post <a href="https://timestabloid.com/update-for-xrp-holders-entire-ledger-wallet-supply-chain-is-under-attack/" rel="noopener noreferrer nofollow">Update for XRP Holders: Entire Ledger Wallet Supply Chain Is Under Attack</a> appeared first on <a href="https://timestabloid.com" rel="noopener noreferrer nofollow">Times Tabloid</a>.

Update for XRP Holders: Entire Ledger Wallet Supply Chain Is Under Attack

Table of Contents

Times Tabloid

Other articles published on Oct 14, 2026

Join our free newsletter for daily crypto updates!