Quick answer: The Ledger theft tally is roughly $91 million from 474 addresses, per Galaxy Research’s Oct. 16, 2026 report, after tampered wallets sold by reseller CryptoBilis leaked recovery phrases. On Oct. 17, ex-Mt. Gox CEO Mark Karpelès said Ledger’s March warning wasn’t enough. CEO Pascal Gauthier replied: “Coming from Mt Gox CEO… Come on man.”
The Ledger theft has a new number and a new fight. Galaxy Research now counts roughly $91 million stolen from 474 addresses after tampered Ledger wallets leaked their owners’ recovery phrases. Then, on Oct. 17, 2026, Ledger CEO Pascal Gauthier and former Mt. Gox CEO Mark Karpelès clashed in public on X over whether Ledger warned buyers in time.
The dispute matters because the Ledger theft goes to the core promise of hardware wallets: that the box you buy is safe. As a result, millions of self-custody users are now asking how to check their own devices.
How much was stolen in the Ledger theft?
In a report published Oct. 16, 2026, Galaxy’s head of research Alex Thorn put the total at about $91 million. The split, by Galaxy’s count:
- $64.5 million in USDT and TRX from 146 TRON addresses
- 213 BTC (about $17.6 million) from 279 bitcoin addresses
- $8.8 million in ETH and stablecoins from 49 Ethereum-type addresses
Still, Galaxy calls its figure “a floor.” Trackers that also count BNB Chain put losses at $93 million to $95 million. Notably, about 88% of the value, roughly $80 million, moved in a single hour starting at 05:00 UTC on Oct. 9.
As of Oct. 15, about $56.6 million still sat at attacker-controlled addresses. In addition, about $13.5 million had gone through Tornado Cash. Meanwhile, Tether froze $10 million of USDT, the only part anyone has stopped so far.
How did the Ledger theft work?
First, the devices were sold by CryptoBilis, which Ledger listed as an authorized reseller for Indonesia, Malaysia and the Philippines. A hidden implant read the screen during setup, captured the 24-word recovery phrase and sent it out over LTE through an eSIM, CoinDesk reported from Ledger’s own update.
Crucially, though, the implant left Ledger’s Secure Element and software untouched. That is why, according to Galaxy, the company’s Genuine Check still passed on tampered units. Ledger says its own systems and direct sales were not compromised, and that every confirmed case involves CryptoBilis. For background, see our earlier reports on the first CryptoBilis losses and the tampered units reported at MediaMarkt.
Why are Ledger’s CEO and Mark Karpelès fighting over the theft?
Karpelès, who helped examine implanted devices, opened Oct. 17 with a correction on X at 10:06 UTC. He conceded that Ledger did publish a Ledger Academy article on implants in March 2026.
However, he kept pressing. At 13:03 UTC he wrote that better communication “instead of a single article buried in the ‘ledger academy’ could have saved 90+ million USD of losses.”
Gauthier had already replied at 12:56 UTC that “you don’t know everything” and that Ledger “goes above and beyond to protect their customers.” Then, at 14:14 UTC, he turned personal: “Coming from Mt Gox CEO… Come on man. You are no white knight.”
For context, Karpelès led Mt. Gox, the exchange that collapsed in 2014. Later, in a long reply at 14:45 UTC, he called the March evidence “a five-alarm fire in the making.” He also added: “I trusted you to do better by learning of my failure – to be better than me.” Finally, he criticized Ledger for still calling it “the CryptoBilis incident” while similar implants surfaced elsewhere.
Is my Ledger wallet safe?
Ledger says the number of affected devices is “limited.” Even so, Galaxy’s advice applies to any brand:
- Buy direct from the manufacturer where you can. CryptoBilis was an authorized reseller.
- Treat any device that arrives set up, or with a printed seed, as compromised.
- Bought from CryptoBilis in the past 90 days? Ledger says don’t set it up. If you already did, move funds to a new device with a newly generated seed.
- Split large balances across vendors or locations, so one bad device isn’t a total loss.
Our guide on how to check if a hardware wallet is genuine covers the physical checks. Also see our self-custody wallet setup guide. Scammers are already posing as “recovery” services, so read how to spot crypto scams too. Ledger will never ask for your 24-word phrase.
Market implications
So far, however, prices haven’t reacted. Bitcoin traded at $81,472, up 0.5% in 24 hours, per CoinGecko at 19:00 UTC on Oct. 17.
Instead, the bigger cost of the Ledger theft is trust. Galaxy notes a rough quarter for “boring” bitcoin infrastructure, from weak Coldcard seeds to a Liquid bridge bug. In each case, the cryptography held; the failure was in the supply chain or operations. Therefore, expect more demand for multi-vendor setups and direct-from-maker sales, and more pressure on Ledger to say how many devices are affected.
Ledger Theft FAQ
How much was stolen in the Ledger CryptoBilis theft?
Galaxy Research counts about $91 million taken from 474 addresses, per its Oct. 16, 2026 report. Trackers that include BNB Chain estimate $93 million to $95 million.
Was Ledger itself hacked?
No breach of Ledger’s systems has been shown. Ledger says the attack used physical implants in devices sold through reseller CryptoBilis. The implant read the recovery phrase off the screen and left the Secure Element untouched.
What did Mark Karpelès say about Ledger?
On Oct. 17, 2026, Karpelès said better communication, instead of a single article “buried” in Ledger Academy in March, “could have saved 90+ million USD of losses.” He called the evidence “a five-alarm fire in the making.”
How did Ledger CEO Pascal Gauthier respond?
Gauthier wrote that Karpelès doesn’t “know everything” and that Ledger “goes above and beyond.” He later added: “Coming from Mt Gox CEO… Come on man. You are no white knight.”
Can stolen funds be recovered?
Only partly so far. Tether froze $10 million of USDT, per Galaxy. The bitcoin and ether have no issuer that can freeze them, and about $56.6 million was still at attacker addresses on Oct. 15.
This article is for information only. It is not financial advice. Always DYOR (do your own research) before you buy a wallet or move funds.
