Compromised Ledger Devices Drive $18 Million in Weekly Crypto Losses, SEAL Reports

The Security Alliance (SEAL) recorded 70 crypto security incidents between October 13 and 20, 2026, with total losses exceeding $18 million across eight categories tracked by the group. The heaviest toll came from compromised Ledger hardware wallets sold through the Malaysian reseller CryptoBilis, a case with direct relevance for European users who have bought devices through third-party retail channels rather than Ledger's own storefront.

Three new victims of the CryptoBilis-linked devices were identified this week, with losses totalling $9.3 million, an average of more than $3 million per victim. Ledger opened its investigation on October 9, confirmed an unauthorized hardware implant in a customer's device on October 10, and by October 11 had linked the pattern of reported losses to units sold by the Malaysian reseller. Ledger's in-house security unit, Ledger Donjon, published a technical update on October 13 describing the implant mechanism. On-chain investigators have since traced $103 million in total funds through Tornado Cash and Zcash in connection with the case.

Ledger has called the scope of the breach "limited."

A separate incident illustrates the risk without the loss: a German customer reported a compromised Ledger device purchased at MediaMarkt, though no funds were taken in that case.

Seed phrases, takeovers and physical risk

Seed phrase compromises accounted for 25 of the week's 70 cases, with losses of $3.86 million, 64.5 ETH and 0.3 BTC. Account takeovers added a further $1.6 million. Two wrench attacks, the industry term for physical coercion to extract crypto assets, cost victims $1.22 million combined. The brief notes that French judicial police reported 41 crypto-related kidnappings in the country as of mid-April 2026, underlining that physical targeting of crypto holders remains an active concern in Europe.

Protocols, North Korea and phishing infrastructure

SEAL counted nine protocol-related reports for the week. Six confirmed protocol compromises produced losses of $2 million and 37.44 ETH, including two exploits each exceeding $1 million. A separate infrastructure takeover cost $32,400 and 5 BTC.

North Korean-linked hacking groups were tied to five victims and $260,000 in losses for the week. Within that total, the