News

Hardware Wallet News 14.10.2026: Ledger Implants

Daily overview for the Baltic and Nordic segment: supply chain attack on Ledger devices, Trezor reseller network review (13.10), and what it means for hardware wallet users in the region.

Toms Ābeltiņš

14 October 20266 min read

Over the past 24-48 hours, the hardware wallet story has dominated our segment: on 12-13 October, Ledger and researchers confirmed the technical operation of an implant and the limitation of 'Genuine Check', while on 13 October, Trezor announced a review of its reseller network. With a chronology and CASP licence context.

Wednesday, 14 October 2026. This is a Day Brief format publication. Over the past 24-48 hours, one rapidly developing story in the hardware wallet category has dominated our segment – crypto exchanges and CASPs, hardware wallets, crypto cards, and tax tools serving the Baltics (LV, LT, EE) and Northern Europe (FI, SE, NO, DK): the confirmed supply chain attack on Ledger devices and Trezor's subsequent reaction. On 13 October, Trezor announced a review of its reseller network, while on 12-13 October, Ledger and independent researchers published technical details of the implant. Regional CASP licence developments older than a week are discussed in the 'Context' section as background, not as fresh news.

Trezor Reviews Reseller Network (13 October)

On 13 October, Trezor announced it was reducing its authorised reseller network. The company's statement on platform X (published around 13:32 UTC) indicated that the number of resellers was being reduced 'so we can more effectively vet who we work with'. A letter from Chief Commercial Officer (CCO) Danny Sanders to affected resellers stated: 'If you are receiving this letter, your authorisation will expire on January 1, 2027.' From the date of the letter, affected resellers will not receive new products, but remaining stock may be sold until 1 January 2027.

Trezor emphasises that there is no evidence of compromise to its devices, and that the decision 'is not a judgement on your business or on the security of the devices you have sold'. The company has not disclosed how many resellers or which countries are affected. On 12 October, Trezor had already removed Southeast Asian retailer CryptoBilis, which is at the centre of the attack, from its reseller list as a precautionary measure. It should be noted separately that this reseller network review follows the August 2026 ShipMonk data breach, which exposed data from approximately 13,689 Trezor customers; Trezor also claimed at the time that its systems and devices were not compromised.

Ledger Implant: Technical Analysis and 'Genuine Check' Limitation (12-13 October)

In parallel, Ledger and independent researchers clarified how the discovered hardware implant works. According to analysis by the research group Tibane Labs, an ST STM32G431KBU6 microcontroller (Arm Cortex-M4, 128 KB memory) was inserted under the battery and antenna in an affected Ledger Nano X device. This, along with a miniature eSIM and a shielded LTE module, read the device's display output and button presses to reconstruct the recovery phrase and send it to the attacker via the mobile network. Researchers described two variants: in the first, the original battery was replaced with a smaller one to make space, while in the second, improved version, components were arranged in foam padding under the OLED display, and markings on the chips were scraped off.

The most important conclusion for regional users is the limitation of Ledger's 'Genuine Check'. Since the implant does not modify the Secure Element, this authentication check does not detect the implant – the Secure Element generates correct cryptographic proof, and the check returns a 'clean' result. Ledger itself warns that 'Genuine Check' is not designed to detect physically added implants if the original Secure Element remains intact. Ledger states that the affected volume is 'limited' and that all confirmed fund losses are associated with devices sold through CryptoBilis.

The extent of the losses is still an estimate, with various sources citing different figures, so we treat them with caution. Pseudonymous investigator Specter estimates losses could exceed $86 million USD; analytics firm Bitquery estimates approximately $92.9 million USD drained from about 311 wallets (of which approximately $70.5 million USD was on the Tron network). Some media outlets cite even higher figures. The exact total has not been confirmed by Ledger.

Chronology of Events

The nature of the attack gradually unfolded. According to researchers, compromised devices appeared for sale from approximately 16 September, often at almost half the original price. On 9 October, reports emerged of drained wallets in Southeast Asia, and Ledger asked CryptoBilis to suspend the sale and delivery of Ledger devices. On 10 October, Ledger confirmed that an unauthorised hardware implant was found in at least one affected user's device. On 12 October, Trezor removed CryptoBilis from its reseller list, and on the same day, Ledger publicly confirmed the existence of the implant in CryptoBilis devices. On 13 October, technical details were published, and Trezor announced a review of its reseller network.

What This Means for Baltic and Nordic Users

Ledger and Trezor are among the most popular hardware wallet brands among retail users in the Baltics and Nordics, so the story is directly relevant to our segment, even though the confirmed epicentre of the attack is a Southeast Asian distributor. To date, confirmed fund losses are associated with one specific distributor outside the region, and there are no confirmed reports of an organised campaign in Baltic or Nordic retail channels.

At the same time, isolated European cases are emerging. According to various publications, a European user found an implant in a Nano X device purchased approximately two weeks before 11 October, even before initialisation (with no reported losses), and security firm SlowMist indicates that Ledger Flex devices from the compromised distribution network are also appearing in EU-related reports. These cases have not yet been conclusively linked to the CryptoBilis campaign, so we treat them as isolated signals, not as a confirmed regional trend. The main practical takeaway for users in the region: buy hardware wallets only from the manufacturer's official store or a directly authorised reseller, not on the secondary market or through resellers.

Context: Regional CASP Licensing (Reminder, Not Fresh News)

These points are not news from the last 24 hours; we keep them under observation with precise previous dates.

Latvian CASP licences: On 1 October, the Bank of Latvia announced the issuance of another crypto-asset service licence to the German-capital company Atrya Technologies SIA (associated with the German company Capelend Technologies GmbH). According to an LSM publication on 2 October, a total of approximately 12 companies in Latvia have now obtained crypto-asset service authorisations under MiCA. This confirms the previously observed trend that the Baltics are becoming one of the most active CASP licensing centres in the EEA. We continue to monitor future ESMA register updates regarding firms in the region.

Tax tools and crypto cards: Within the week, there have been no clearly dated announcements from the last 24-48 hours in our monitored tax tools (Koinly, Blockpit, Divly) and regional crypto card products that would warrant separate news. These categories remain under observation.

Summary for Market Participants

The hardware wallet supply chain has become a real attack vector. Even if the confirmed epicentre is outside the region, this is a moment for Baltic and Nordic users to review their purchasing channels and buy only from the manufacturer's official store or a directly authorised reseller.

Do not rely solely on 'Genuine Check'. Ledger itself confirms that this check does not detect a physically added implant if the secure element is intact. A physical inspection of the device (inconsistent battery, antenna cable, damaged casing) can be more informative than a software check.

Evaluate loss figures critically. The published sums (from approximately $86 million to over $90 million) are estimates by researchers and analytics firms, not a total confirmed by Ledger; the extent of the attack is still being clarified.

The reseller issue also affects the region. Trezor's review of its reseller network until 1 January 2027 may impact where and from whom Baltic and Nordic buyers acquire devices; follow manufacturers' official lists of authorised resellers.

Monitor the next ESMA register and Bank of Latvia updates – the movement of regional CASP authorisations remains the most important structural indicator for our segment in the coming weeks.

Norriwire Briefing