Security Researcher Taylor Monahan Traces New Ledger Loss Reports to Panic-Driven Scams

Panic Scams, Not Device Drains

Security researcher Taylor Monahan says the latest Ledger-related loss reports she has handled trace to scams aimed at panicked owners rather than to the tampered devices at the center of the CryptoBilis affair. On the Oct. 14 episode of Uneasy Money, the podcast she co-hosts, Monahan said the cases that reached her in recent days were not Ledger drains caused by the cellular component found in wallets sold by reseller CryptoBilis. She has spent the week collecting incident reports, is working directly with Ledger and has had help from Trezor, another hardware wallet maker, though she did not disclose a case count. The routes she listed: fraudulent Google ads that surface when users search to install Ledger Live, counterfeit applications, phishing sites, emails written to frighten owners, and phone calls placed to victims directly. Ledger Live is the company's companion application for managing accounts, which makes its search results a recurring target for advertising fraud. Every one of these paths, she said, stacks fresh losses on top of the original theft simply because people panic, the fear-driven mirror image of FOMO buying. Her advice was blunt: do not panic. None of these routes requires physical access to a device, which is what separates them from the implant case. The affected devices in the reports she examined were purchased between June and early October, she added. Monahan still uses her Ledger and Trezor hardware and plans to be more careful about where she buys such devices, keeping her holdings spread across many devices, locations and paper backups so that no single failure can wipe her out. Co-host Austin Griffith pointed to multisig setups as one alternative, an arrangement in which a hardware wallet is only one of several required signers and can be replaced if it leaks or is lost.

The $102M CryptoBilis Implant Tally

The underlying incident itself remains only partly quantified. Ledger said on Oct. 13 that an unauthorized component hidden inside CryptoBilis wallets read the 24-word Ledger Recovery Key displayed on the device screen and transmitted it outward over a cellular connection. A recovery phrase is the full master key to a wallet: anyone holding its 24 words can rebuild the accounts and move every asset in them. The company has stated that every confirmed loss involves a device sold through CryptoBilis, not its first-party store, and it has not confirmed an overall damage figure or said how many units carried the unauthorized part. On-chain data from Bitquery counts $102.0 million taken from 324 wallets, an investigator tally rather than a total Ledger has verified. Copycat attempts are already circulating. Blockchain security firm SlowMist warned on Oct. 16 of a phishing campaign posing as a Ledger firmware update that uses the incident as bait; that alert stands apart from the cases Monahan described, and neither side has claimed a connection. SlowMist's alert landed two days after Ledger's support post. In September, Zscaler ThreatLabz documented a separate operation that ran fraudulent Google ads to steer Ledger users toward a fake page harvesting recovery phrases, again with no reported link to her cases. Ledger's support team set the boundary in an Oct. 14 post on X, writing that the company will never call customers, send them direct messages or request the 24-word phrase.

@SlowMist_Team · X post

Warned on Oct. 16.

View on X

One Breach, Two Loss Layers

Read together, the two records describe a two-layer loss event: direct drains from the implanted devices, then a second wave of theft that feeds on the fear the first wave created. The primary record still lacks a company-confirmed total; the $102 million figure is Bitquery's count, and Ledger has verified only that every confirmed loss traces to a CryptoBilis purchase. Until Ledger's assessment is complete, the practical defenses are unchanged: treat any call, message or advertisement that asks for a recovery phrase as an attack, buy hardware only through first-party channels, and consider multisig or an additional device such as the Tangem Mobile Wallet so a single compromised signer is not fatal. Our guide to crypto scams to avoid walks through these red flags in detail.