On Friday, October 30, 2026, Kenneth Baylor filed a class action complaint in the US District Court for the Northern District of California against Ledger SAS, the French maker of Ledger hardware wallets, alleging that spyware concealed in devices he bought allowed the theft of cryptocurrency valued at about $1.05 million.
Baylor, a San Mateo County, California resident, says he bought two Ledger Flex devices from CryptoBilis, which Ledger listed as an official reseller, on July 13 and September 4, 2026, paying about $620. According to the complaint, he ran Ledger’s Genuine Check through the company’s official application, received results identifying both devices as genuine, and then generated new recovery information on them, which he says he kept offline.
The complaint states that on or about October 9, 2026, 10.66256803 bitcoin and 58.991906189521260209 ether were transferred out without his authorization. Baylor alleges, on information and belief, that one or more of the devices was physically altered before delivery so that an unauthorized component captured recovery information generated during setup while the original Secure Element still passed Genuine Check.
Baylor cites Ledger’s own published materials, which he
Baylor cites Ledger’s own published materials, which he says state that Genuine Check cannot detect unauthorized physical modifications if the original Secure Element remains intact. He alleges Ledger did not adequately disclose that limitation during setup and that the Flex packaging was secured only by ordinary paper strips.
The complaint also recounts public developments. It says Ledger confirmed on October 10 that one user’s device contained an unauthorized hardware implant, and on October 11 directed CryptoBilis purchasers not to initialize unused devices. It says MediaMarktSaturn suspended Ledger sales on October 13 in coordination with Ledger.
According to the complaint, Ledger’s October 15 response said sampled stock units were clean, denied a flaw in its chip, operating system, or servers, and called the event a localized distribution attack. The filing also cites reports of suspected implants in other Ledger models and through other retailers, some of which it describes as unverified.
Baylor brings six counts: breach of express warranty,
Baylor brings six counts: breach of express warranty, violation of the Consumers Legal Remedies Act, negligence, strict liability for design defect, strict liability for failure to warn, and violation of California’s Unfair Competition Law. The consumer-law counts seek injunctive relief only. The complaint says he will provide the notice required by Civil Code section 1782 and later seek damages under the act. He demands a jury trial.
He seeks to represent a class of natural persons who bought a Ledger hardware wallet for personal, family, or household use and suffered an unauthorized cryptocurrency loss through spyware installed before delivery. The proposed class is not limited to CryptoBilis, a particular model, or a country of purchase.
Beyond damages, the complaint asks the court to order Ledger to correct its statements about its reseller network, disclose the limits of Genuine Check, and create a Ledger-funded recall, professional inspection, and secure-replacement program that would not require owners to open their devices.
Please contact BlockTribune for access to a copy of this filing.
