Ledger Hack: What a Wallet Breach Means for You

Ledger is investigating reports that customers who bought devices through CryptoBilis, a Southeast Asian reseller, lost crypto to what looks like a hardware supply chain attack. Ledger itself puts the early figure near $86 million. A blockchain analytics firm, Bitquery, separately counted about $92.9 million drained from 311 wallets across five chains. Ledger has asked CryptoBilis to halt sales and shipments, told recent buyers not to set up their devices at all, and says it has no indication that its own systems were compromised. On October 10 it added the first hard finding: one affected customer's device contained an unauthorized hardware implant. CoinDesk's reporting on the investigation lays out the timeline so far. This is still an open case, a Ledger hack with the mechanism unconfirmed, the loss total moving between outlets, and reporting that the reseller changed owners in March, with no established link to the breach yet.

Solo miners and self-custody Bitcoin holders are exactly the audience asking the sharpest questions about this right now, because the entire premise of holding your own keys is that nobody else can lose them for you. A compromised device breaks that premise in a way no pool policy can fix. Here are the questions worth asking plainly.

What Actually Happened in the Ledger Hack?

The working theory is that some Ledger devices sold through CryptoBilis were tampered with before they ever reached a buyer. Ledger has now confirmed that one affected user's device held an unauthorized hardware implant. What it has not said is who installed it, where the alteration happened, how many devices are affected, or whether the implant caused the drains. Tether has frozen roughly $10 million in USDT across 20 addresses tied to the case. None of that settles the mechanism, but it points to a tampered batch rather than a flaw in Ledger's own firmware or software.

Is This Ledger's Fault, or the Reseller's?

As of now, nobody outside the investigation actually knows, and anyone telling you otherwise is guessing. Ledger says its own systems were not breached, which points toward the reseller's supply chain rather than Ledger's manufacturing or software. But it is also unclear whether CryptoBilis introduced the tampering itself, had an employee do it, or was supplied with already-compromised units. The honest answer today is: the device you buy is only as trustworthy as every hand it passed through before it reached you, and that chain is longer and less visible than most buyers assume.

Does a Hardware Wallet Hack Have Anything to Do With a Mining Pool?

It is worth separating two different kinds of custody, because this story mixes them up for a lot of readers. One kind is pool custody: whether the service you point your hashrate at ever holds your mined reward in its own account before paying you. The other is device custody: whether the physical hardware holding your private keys can be trusted not to leak them. The Ledger case is entirely the second kind. It has nothing to do with how any mining pool handles a block reward.

NexusPool's own design only ever touches the first kind. The coinbase transaction that pays a found block is built to send the reward straight to the miner's own address, with nothing held back. The block pays your address. There is no balance for us to hold. 0% pool fee. Payout Preflight shows the exact coinbase that would pay you on the current block, before any block has actually been found, which is a direct answer to "does the pool ever have my coins in the first place." It is a useful answer. It is also not an answer to the Ledger question at all.

If a Pool Never Touches My Coins, Am I Immune to This?

No, and it would be dishonest to imply otherwise. A non-custodial pool removes exactly one risk: the risk that a pool operator's business decisions, balance sheet, or bad actors ever sit between your hashrate and your reward. It does nothing for the hardware that holds the private key for the address that reward gets sent to. If that hardware is compromised, a perfectly non-custodial mining payout still lands on an address an attacker can empty the moment it arrives. NexusPool's technology page describes how the payout path itself works, and it is worth reading precisely because it is narrow: it covers how a block gets paid, not how you should secure the device that controls where it gets paid to.

What Should You Actually Do Right Now?

If you bought a Ledger device through CryptoBilis or any reseller you cannot independently verify, do not set it up, and treat any seed phrase it already generated as burned. Ledger's own guidance is to move funds to a new device and generate a fresh recovery phrase on that new, verified hardware. More generally, buy hardware wallets directly from the manufacturer or an explicitly authorized retailer, and be skeptical of unusually cheap resale listings. None of this is investment advice, and nothing about where a mining reward is routed can substitute for verifying the integrity of the device that holds your keys. A signed record of the work a pool counted from your rig, the kind NexusPool's Glass Ledger publishes each hour, tells you whether the pool is being honest about your shares. It tells you nothing about whether your hardware wallet has been tampered with, and no pool, NexusPool included, can honestly claim otherwise.

So: does the Ledger hack affect NexusPool users? Only exactly as much as it affects any bitcoin holder, since the risk lives in a specific reseller's supply chain and the device it shipped, not in whether a pool ever held your reward.

Trust nothing. Verify where your keys actually live, not just where your mining reward gets sent.