#LedgerResellerSecurity
About LedgerResellerSecurity
Ledger says confirmed theft cases so far involve devices sold by Southeast Asian reseller CryptoBilis, with few devices affected. It confirmed an unauthorized implant in one device and says its systems and direct sales show no signs of compromise. Researchers estimate over $86M in suspected losses, but the total and any link to the implant remain unverified. A European buyer also reported a suspicious component in a reseller device; this claim is unverified. Is the risk confined to one channel?
Suosittu
Viimeisin
LedgerResellerSecurity Suositut postaukset
#Ledger Investigation Update: The Theft Is Temporarily Concentrated in a Single Channel
The boss has something to say
The latest update on the Ledger investigation is out. The theft cases are concentrated at the Southeast Asian distributor CryptoBilis; no breaches have been found in the official direct sales channels. However, a European user reported that devices bought from a local authorized dealer also contained suspicious components.
One uncomfortable lesson from the reported Ledger reseller incident: buying a hardware wallet is not the same as guaranteeing security.
Ledger is investigating reports of losses involving devices sold through a reseller, and the full cause and scale have not been confirmed.
For self-custody, your security routine matters as much as the device: verify the source, protect your recovery phrase, and never enter it on an untrusted website.
Would you buy a hardware wallet from an unknown reseller?
money from the ledger wallet drains, which hit buyers from reseller cryptobilis, now reaches binance. on october 10 the attacker swapped 5.1m usdd back to usdt and paid five otc brokers. those brokers sent 5.2m usdt to three binance addresses. binance records can identify the accounts, but binance freezes funds only with a police or court order. the brokers also serve other clients, so the stolen share is unknown.
AN UNINVITED GUEST INSIDE A COLD WALLET.
Ledger confirmed an unauthorized hardware implant in one affected customer’s device.
It’s investigating reported losses among CryptoBilis buyers in Southeast Asia. On-chain analysts estimate over $86M stolen; Ledger has not confirmed the figure or cause.
Bought there in the past 90 days? Ledger advises against setting up unused devices.
A security breach may begin long before the first transaction.
#LedgerResellerProbe
they didn’t hack ledger. they didn’t exploit the code. they BOUGHT the company selling you the device. $86 million gone
a company called CryptoBilis was an authorized ledger reseller in southeast asia. trusted. legit. sold ledgers for years
a random chinese company quietly bought CryptoBilis from its malaysian owner
made the original owner sign a confidentiality agreement. he couldn’t tell anyone the company was sold
same brand name. same website. same “authorized reseller” badge. but different people behind it now
the new owners started opening every ledger device before shipping
soldered a tiny spy chip onto the board inside. repackaged it. sealed the box. shipped it
the device looked normal. felt normal. worked normal
but the spy chip was silently capturing your private keys the moment you set it up
your seed phrase was sent to the attacker before you even finished writing it down
hundreds of wallets across ethereum tron and bitcoin. all drained
the guy who lost $5.3 million said “i did everything right. no leverage. no memecoins. i stored my funds on a hardware wallet like we’re all told to”
he was right. he did everything right
except his device had a parasite inside it that he couldn’t see
ledger has now told CryptoBilis to stop all sales. told recent buyers NOT to set up their devices
mark karpelès posted photos of the implant. normal board on top. spy chip below
the most dangerous attack in crypto this year wasn’t a line of code
it was a business acquisition
Key News
· 10/10 Crash Anniversary: One year after 70B before the crash to ~$30B by mid-December 2025.
· Ledger Security Fallout: A suspected Ledger reseller hack saw 93.4M in crypto stolen. Hardware wallet manufacturer Ledger launched an investigation; reseller CryptoBilis suspended all sales in Malaysia, Philippines, and Indonesia.
· Hacker Shorts $BTC with 40x Leverage: A wallet received 263 ETH from Tornado Cash, sold it for $643K USDC, and deposited into Hyperliquid to short 305.5
Hashmeta_x
Crypto markets are showing a modest rebound today, with $BTC holding above $82,500 after a brutal week of liquidations. The Fear & Greed Index climbed back to 64 (Greed) from 59 yesterday, signaling sentiment is recovering, though Treasury yields near 5.25% continue to cap upside.
UPDATE: Ledger said all confirmed fund losses in the CryptoBilis incident involve signers sold by the Southeast Asian reseller, while noting it has not confirmed the total number of affected users or the total value lost.
Its Donjon team found an unauthorized implant that reads recovery phrases displayed during setup and transmits them over LTE.
The Block
THE BLOCK: Ledger said it is investigating reports of lost funds involving users in Southeast Asia who purchased devices from reseller CryptoBilis.
Ledger said it has asked CryptoBilis to pause sales and shipments while the investigation continues. It advised customers who bought devices from the reseller in the past 90 days not to set them up, or to move their assets to a new Ledger signer with a new seed if already set up.
Onchain investigator Specter estimated that more than $86 million had been drained from hundreds of wallets across Bitcoin, Ethereum and Tron. Security researcher tanuki42 earlier put the losses at more than $72 million and said the figure was increasing.
bitcoin:native, ethereum:native, $TRON
YOUR LEDGER IS COMPROMISED ❌
Here’s everything we know about the hack.
You should know it too :
🔴 WHAT HAPPENED
On Oct 9, wallets across Southeast Asia (mostly Indonesia, Malaysia, Philippines) started getting drained. Hundreds were swept within seconds of each other.
On-chain sleuths like Specter and tanuki42 traced the funds within hours. The pattern: all victims bought their Ledger from the same seller, CryptoBilis, a listed authorized reseller for those markets.
Ledger asked CryptoBilis to pause all sales and shipments the same day.
🔴 HOW THE HACK WORKS
On Oct 10, Ledger confirmed it: a hardware implant was found inside an affected device. Not a software bug. Someone physically opened genuine Ledgers and added a spy circuit.
The implant reportedly has:
- a microcontroller
- an LTE module + eSIM + antenna
- placement where the screen padding normally goes
It taps the line between the secure chip and the display. When you set up the wallet, your 24 words show on screen, the implant reads them and sends them out over cellular. No Wi-Fi or USB needed.
The secure chip is untouched, so the device still passes Ledger's Genuine Check. Packaging can look fully intact. Researchers (incl. Mark Karpelès via Tibane Labs) found multiple implant generations, newer ones smaller and harder to spot.
🔴 THE DAMAGE (third-party estimates)
Bitquery: ~$93M-$102M across 315+ wallets
YFarmX: ~$103M across 530 addresses
Biggest chunk: ~$79M USDT on TRON
The attacker was patient: weeks of small test transactions before the big sweep.
Funds moved through Tornado Cash, Zcash shielded pools, THORChain and USDT to USDD swaps. Tether froze ~$10M. Some USDC may still be freezable by Circle.
🔴 LEDGER'S POSITION
- All confirmed cases trace back to CryptoBilis
- Calls the volume "limited"
- Says its own systems and direct sales were not compromised
- No official loss figure yet
CryptoBilis has stopped selling hardware wallets. OneKey also revoked its authorization.
🔴 STILL UNCONFIRMED
Users in Europe are posting photos of similar implants, with several claims pointing to MediaMarkt stores in Germany. Some of those devices had no funds drained, and Ledger hasn't linked them to this attack. Treat as reports under investigation.
🔴 WHAT TO DO
Bought from CryptoBilis in the last ~90 days?
- Don't set up an unused device
- Already set one up? Move funds to a new seed on a new device, ideally bought direct from Ledger
Expect scammers. Ledger will never call you, DM you, or ask for your 24 words.
🔴 THE LESSON
Your hardware wallet is only as safe as the chain of hands it passed through. Buy direct when you can. When you can't, know exactly who your seller is.
Image credits: @0xJohannes_
The teams and I are focused on the CryptoBilis incident.
If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
If you have a tampered signer, contact Ledger Support before sending it anywhere. We want to examine tampered signers, and Support will give shipping instructions. If you lost funds, file a report with local law enforcement first and coordinate with them before opening or sending the signer.
Ledger is reviewing its reseller controls and anti-tamper protections. We invite researchers and other vendors to work with us on tamper-detection and chain-of-custody practices. If you did not buy from CryptoBilis and want to inspect the inside of your signer, the guide is at Use caution and make sure your recovery phrase is backed up first, because opening a signer can damage it.
Some claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates.