{ "version": 1, "event_id": "evt_c594d0e29e7b400b", "url": "https://xiyu.news/events/evt_c594d0e29e7b400b/", "json": "https://xiyu.news/api/events/evt_c594d0e29e7b400b.json", "type": "security_incident", "status": "developing", "category": "crypto", "title": { "zh": "Ledger 硬件钱包供应链植入窃密组件事件", "en": "Ledger Hardware Wallet Supply Chain Implant Seed Theft Incident" }, "current_state": { "zh": "Ledger披露，一个高度组织化的犯罪团伙花费数百万美元购买正版Ledger设备，植入隐藏组件以在初始化过程中窃取助记词，并通过东南亚分销商转售，促使Ledger暂停销售并更改东南亚和香港授权经销商的交付规则，同时与执法部门和SEAL 911合作追踪资金。", "en": "Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds." }, "first_seen_at": "2026-10-09T15:30:47.822838+00:00", "last_updated_at": "2026-10-16T05:41:23.632033+00:00", "last_material_change_at": "2026-10-16T05:41:23.632033+00:00", "confidence": 0.75, "updates_count": 47, "sources_count": 86, "entities": [ "affected", "after", "all", "alleges", "another", "asia", "asian", "binance", "bitquery", "blockbeats", "bought", "buyer", "calls", "cases", "cash", "ceo", "chain", "ciso", "company", "confirmed", "confirms", "contained", "cryptobilis", "cryptobillis", "cuts", "device", "devices", "drain", "draining", "drains", "europe", "express", "finds", "flags", "flex", "former", "founder", "free", "from", "frozen", "german", "gox", "hack", "hackers", "halts", "hardware", "hong", "impacted", "implant", "infiltrated", "investigates", "involve", "its", "karpel", "keeps", "kong", "largest", "ledger", "ledgers", "linked", "lte", "maker", "malaysia", "malic", "many", "mediamarkt", "mediamarktsaturn", "million", "mod", "months", "off", "offers", "onekey", "organized", "phrases", "probes", "purchased", "quarantine", "recall", "recovery", "replacements", "report", "reports", "reseller", "resellers", "sales", "says", "scammer", "second", "self", "self-custody", "sold", "southeast", "southeast-asia", "specter", "spy", "spyware", "stole", "supply", "suspected", "syndicate", "tampered", "tether", "that", "tied", "tornado", "tornado-cash", "trezor", "unauthorized", "urges", "usdt", "user", "wallet", "wallet-drain", "wallets", "warning", "world" ], "identifiers": [], "topics": [ "asia-regulation", "asset-theft", "cfcft", "consumer-protection", "crypto-security", "crypto-theft", "cryptobilis", "custody", "fund-losses", "fund-theft", "fund-tracing", "funds-frozen", "funds-theft", "germany", "hacks-exploits", "hardware-wallets", "ledger", "on-chain-analysis", "onekey", "security-breach", "security-disclosure", "security-incident", "seed-phrase", "seed-phrase-theft", "self-custody", "southeast-asia", "spyware", "supply-chain", "supply-chain-attack", "supply-chain-security", "tampering", "tether", "tether-freeze", "theft", "tornado-cash", "trezor", "usdt-freeze", "wallet-drain", "wallet-security", "wallet-tampering" ], "updates": [ { "update_id": "upd_957c41b0f311ca8b", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T12:28:02Z", "published_at": "2026-10-09T12:28:02Z", "first_seen_at": "2026-10-09T15:30:47.822838Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "【Specter：数百个 Ledger 用户钱包疑似被盗，损失超 8600 万美元】", "title_en": "【Specter：数百个 Ledger 用户钱包疑似被盗，损失超 8600 万美元】", "what_changed_zh": "链上分析师Specter报告称，数百名Ledger用户的钱包在以太坊、TRON和比特币上被盗空，已追踪的被盗资金超过8600万美元。", "what_changed_en": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "current_state_zh": "链上分析师Specter报告称，数百名Ledger用户的钱包在以太坊、TRON和比特币上被盗空，已追踪的被盗资金超过8600万美元。", "current_state_en": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "detailed_summary_zh": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "detailed_summary_en": "Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120050", "telegram:theblockbeats:199711", "rss:www.theblock.co_rss.xml:26f3cdd1777d905d", "rss:cointelegraph.com_rss:6368221780010688", "google_news:article:b949392d4e1fa6fe" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114863", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371031?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163", "label": "The Block", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://u.today/binance-founder-cz-urges-wallet-quarantine-after-86-million-ledger-reseller-hack?amp", "label": "U.Today", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_4cfb1aa869db284c", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T13:47:05Z", "published_at": "2026-10-09T13:47:05Z", "first_seen_at": "2026-10-09T15:30:47.825240Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【Ledger：正调查东南亚用户资金损失报告，涉事设备购自经销商 CryptoBilis】", "title_en": "【Ledger：正调查东南亚用户资金损失报告，涉事设备购自经销商 CryptoBilis】", "what_changed_zh": "Ledger正在调查东南亚用户通过经销商CryptoBilis购买的设备资金失窃的报告，已要求该经销商暂停销售和发货，并建议受影响用户放弃90天购买窗口内的设备，或将资产迁移到使用全新助记词的新设备，链上分析师估计有7200万至8600万美元以上从数百个比特币、以太坊和TRON钱包中被盗走。", "what_changed_en": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "current_state_zh": "Ledger正在调查东南亚用户通过经销商CryptoBilis购买的设备资金失窃的报告，已要求该经销商暂停销售和发货，并建议受影响用户放弃90天购买窗口内的设备，或将资产迁移到使用全新助记词的新设备，链上分析师估计有7200万至8600万美元以上从数百个比特币、以太坊和TRON钱包中被盗走。", "current_state_en": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "detailed_summary_zh": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "detailed_summary_en": "Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120059", "google_news:article:8d92198eb6731338", "rss:www.coindesk.com_arc_outboundfeeds_rss_:7d9e10556fc49745", "telegram:theblockbeats:199729", "rss:thedefiant.io_api_feed:83013e60c7a4c059", "telegram:wublockchainenglish:26349", "rss:decrypt.co_feed:fe41f2c338b44da9" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114872", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://bitpinas.com/business/ledger-cryptobilis/", "label": "BitPinas", "source_type": "google_news", "official": false }, { "url": "https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://m.theblockbeats.info/flash/371049?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://thedefiant.io/news/hacks/ledger-asks-cryptobilis-to-halt-sales-amid-reports-of-lost-funds", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://wublockchain.xyz/news/news-21176", "label": "wublockchainenglish", "source_type": "telegram", "official": false }, { "url": "https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e4d5e427fda7b7b2", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T14:05:02Z", "published_at": "2026-10-09T14:05:02Z", "first_seen_at": "2026-10-09T15:30:48.094719Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "⚡️CZ警告Ledger硬件钱包供应链攻击风险，疑似单一经销商出售假冒或遭篡改设备", "title_en": "⚡️CZ警告Ledger硬件钱包供应链攻击风险，疑似单一经销商出售假冒或遭篡改设备", "what_changed_zh": "CZ公开警告Ledger硬件钱包用户注意供应链攻击风险，称事件疑似局限于一家经销商（CryptoBilis）出售假冒或遭篡改设备，并呼吁BNB生态及加密行业协助追踪被盗资金。", "what_changed_en": "CZ publicly warned Ledger hardware wallet users about supply-chain attack risk, saying the incident appears limited to one reseller (CryptoBilis) selling counterfeit or tampered devices, and called on BNB ecosystem and crypto industry to help track stolen funds.", "current_state_zh": "Ledger正调查东南亚用户通过CryptoBilis购买设备后资金被盗事件，已要求该经销商暂停销售和发货；CZ公开警告供应链攻击风险并呼吁行业协助追踪被盗资金；链上估计损失超过8600万美元。", "current_state_en": "Ledger is investigating the theft of funds from Southeast Asian users who bought devices via CryptoBilis, has told the reseller to pause sales and shipping; CZ publicly warned of supply-chain attack risk and called for industry help tracking stolen funds; on-chain estimates exceed $86M.", "detailed_summary_zh": "CZ warned Ledger users about a supply-chain attack in which a single reseller (CryptoBilis) apparently sold counterfeit or tampered devices, amid a Ledger investigation into Southeast Asian users' stolen assets and on-chain estimates of over $86 million losses across hundreds of Bitcoin, Ethereum and Tron wallets.", "detailed_summary_en": "CZ warned Ledger users about a supply-chain attack in which a single reseller (CryptoBilis) apparently sold counterfeit or tampered devices, amid a Ledger investigation into Southeast Asian users' stolen assets and on-chain estimates of over $86 million losses across hundreds of Bitcoin, Ethereum and Tron wallets.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.9, "story_ids": [ "telegram:theblockbeats:199737" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371057?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_a1ad1970d1cb1998", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T15:22:02Z", "published_at": "2026-10-09T15:22:02Z", "first_seen_at": "2026-10-09T15:30:48.099074Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "⚡️Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT", "title_en": "⚡️Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT", "what_changed_zh": "一起与Ledger相关的安全事件造成近9000万美元损失，MistTrack正在追踪这些资金，Tether已冻结与此次事件相关地址中的大量USDT。", "what_changed_en": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "current_state_zh": "一起与Ledger相关的安全事件造成近9000万美元损失，MistTrack正在追踪这些资金，Tether已冻结与此次事件相关地址中的大量USDT。", "current_state_en": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "detailed_summary_zh": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "detailed_summary_en": "A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199750", "telegram:foresightnews:120066", "rss:thedefiant.io_api_feed:cdfb2c223025d673", "telegram:theblockbeats:199754" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371070?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/114879", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://thedefiant.io/news/hacks/tether-freezes-usdt-linked-to-ledger-user-thefts-misttrack-says", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "http://ledger.com/", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_7b3809f6e263a250", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T15:34:19Z", "published_at": "2026-10-09T15:34:19Z", "first_seen_at": "2026-10-09T18:27:25.800543Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "许多从经销商 CryptoBillis 购买设备的 #Ledger 用户已经", "title_en": "Many #Ledger users who bought their devices from reseller CryptoBillis have had", "what_changed_zh": "Lookonchain 报告称，一名用户（地址 TY24Ya）三周前从经销商 CryptoBilis 购买 Ledger 设备并存入 700 万 USDT，约 10 小时前全部被盗，可能是此次事件中最大单笔损失。", "what_changed_en": "Lookonchain reports that one user (address TY24Ya) bought a Ledger device from reseller CryptoBilis three weeks ago and deposited 7M USDT, all of which was stolen about 10 hours before the report, possibly the largest single loss in the incident.", "current_state_zh": "与 Ledger 相关的供应链攻击事件确认损失近 9000 万美元，MistTrack 正在追踪资金，Tether 已冻结相关地址中的大量 USDT，并新增一名被盗 700 万 USDT 的可能最大受害者。", "current_state_en": "The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds, Tether freezing substantial USDT in related addresses, and a new possible largest victim losing 7M USDT.", "detailed_summary_zh": "Users who purchased Ledger hardware wallets from reseller CryptoBillis have reportedly had funds drained, with total losses approaching $90M, including one victim who lost 7M USDT about 10 hours before the report.", "detailed_summary_en": "Users who purchased Ledger hardware wallets from reseller CryptoBillis have reportedly had funds drained, with total losses approaching $90M, including one victim who lost 7M USDT about 10 hours before the report.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.95, "story_ids": [ "telegram:lookonchainchannel:10562", "telegram:theblockbeats:199753" ], "sources": [ { "url": "https://arkm.com/explorer/address/TY24Ya7z1zHn4Br38SgwSxdvcbD9syWg6D", "label": "lookonchainchannel", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371073?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_e6442c6a6ffae573", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:02:02Z", "published_at": "2026-10-09T16:02:02Z", "first_seen_at": "2026-10-09T18:27:27.032374Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "🔍 链上侦探 | 某用户6月抄底80枚BTC浮盈138万美元，一周前存入Ledger现已全部被盗", "title_en": "🔍 链上侦探 | 某用户6月抄底80枚BTC浮盈138万美元，一周前存入Ledger现已全部被盗", "what_changed_zh": "Lookonchain 报告另一名受害者：约四个月前以约 520 万美元买入 80 枚 BTC，一周前从经销商 CryptoBilis 购买 Ledger 硬件钱包并将全部 BTC 转入，现已被全部盗走；该案被与 CryptoBilis 客户资金被盗事件关联，但设备是否遭篡改、攻击方式和攻击者身份仍未证实。", "what_changed_en": "Lookonchain reports another victim: a user bought 80 BTC about four months earlier for ~$5.2M, moved all BTC into a Ledger hardware wallet bought a week earlier from reseller CryptoBilis, and the entire balance was stolen; the case is linked to other CryptoBilis customer drains, though device tampering, attack method and attacker identity remain unconfirmed.", "current_state_zh": "与 Ledger 相关的供应链攻击事件确认损失近 9000 万美元，MistTrack 正在追踪资金，Tether 已冻结相关地址中的大量 USDT，并新增一名被盗 700 万 USDT 的可能最大受害者；最新报告又确认一名从 CryptoBilis 购买 Ledger 并转入 80 枚 BTC 的受害者资金被盗，设备篡改与攻击者身份仍未证实。", "current_state_en": "The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds, Tether freezing substantial USDT in related addresses, and a new possible largest victim losing 7M USDT; the latest report adds another victim who bought a Ledger from CryptoBilis and had 80 BTC drained, while device tampering and attacker identity remain unconfirmed.", "detailed_summary_zh": "A user who moved 80 BTC (~$5.2M cost basis, ~$1.38M paper profit) into a Ledger hardware wallet bought a week earlier from reseller CryptoBillis has had the entire balance stolen, with Lookonchain linking the case to other CryptoBillis customers whose funds were also drained.", "detailed_summary_en": "A user who moved 80 BTC (~$5.2M cost basis, ~$1.38M paper profit) into a Ledger hardware wallet bought a week earlier from reseller CryptoBillis has had the entire balance stolen, with Lookonchain linking the case to other CryptoBillis customers whose funds were also drained.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.96, "story_ids": [ "telegram:theblockbeats:199756", "telegram:lookonchainchannel:10564" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371076?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://arkm.com/explorer/address/bc1q9r0jxknrtlc96dankvgkwa0347569rc6dn53fs", "label": "lookonchainchannel", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_3c47b16f0e93d4b8", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:10:02Z", "published_at": "2026-10-09T16:10:02Z", "first_seen_at": "2026-10-09T18:27:27.032555Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Mt.Gox前CEO称发现被植入间谍模块的Ledger硬件钱包，可通过LTE发送助记词信息", "title_en": "Mt.Gox前CEO称发现被植入间谍模块的Ledger硬件钱包，可通过LTE发送助记词信息", "what_changed_zh": "Mt. Gox 前 CEO Mark Karpelès 披露，他从马来西亚收到的一台 Ledger 硬件钱包内含隐藏间谍模块，配备 LTE、天线、eSIM 以及连接到设备 SPI 总线的微控制器，能够捕获显示的字符并在设置后窃取助记词，并敦促用户遵循 Ledger 的官方设备验证指引。", "what_changed_en": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "current_state_zh": "Mt. Gox 前 CEO Mark Karpelès 披露，他从马来西亚收到的一台 Ledger 硬件钱包内含隐藏间谍模块，配备 LTE、天线、eSIM 以及连接到设备 SPI 总线的微控制器，能够捕获显示的字符并在设置后窃取助记词，并敦促用户遵循 Ledger 的官方设备验证指引。", "current_state_en": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "detailed_summary_zh": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "detailed_summary_en": "Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199757", "telegram:theblockbeats:199769", "telegram:foresightnews:120090" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371077?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371089?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/article/detail/100813", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_5c9d7389e1a2ec22", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:31:02Z", "published_at": "2026-10-09T16:31:02Z", "first_seen_at": "2026-10-09T18:27:27.032951Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "⚡️Ledger盗币黑客向Tornado Cash转入107万美元ETH，部分资金流入Binance热钱包", "title_en": "⚡️Ledger盗币黑客向Tornado Cash转入107万美元ETH，部分资金流入Binance热钱包", "what_changed_zh": "嫌疑人通过 4 个钱包向 Tornado Cash 转入 430.2 ETH（约 107 万美元），并在 Tether 冻结后通过 SUN.io 及 USDD PSM 将 USDT 兑换为 USDD，部分资金流入 Binance 热钱包；相关钱包仍持有约 7060 万美元资产。", "what_changed_en": "Suspects moved 430.2 ETH (~$1.07M) to Tornado Cash via 4 wallets, and after Tether's freeze converted USDT to USDD via SUN.io and the USDD PSM, with some funds routed to a Binance hot wallet; suspect wallets still hold ~$70.6M.", "current_state_zh": "与 Ledger 相关的供应链攻击事件确认损失近 9000 万美元，MistTrack 正在追踪资金，Tether 已冻结相关地址中的大量 USDT；最新链上监测显示嫌疑人已向 Tornado Cash 转入 430.2 ETH（约 107 万美元），并通过 SUN.io 及 USDD PSM 将 USDT 兑换为 USDD，部分资金流入 Binance 热钱包，相关钱包仍持有约 7060 万美元资产；设备篡改与攻击者身份仍未证实。", "current_state_en": "The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds and Tether freezing substantial USDT; latest on-chain monitoring shows suspects moved 430.2 ETH (~$1.07M) to Tornado Cash and converted USDT to USDD via SUN.io and the USDD PSM, with some funds routed to a Binance hot wallet, while suspect wallets still hold ~$70.6M; device tampering and attacker identity remain unconfirmed.", "detailed_summary_zh": "Suspects in the ~$90M Ledger distributor theft moved 430.2 ETH (~$1.07M) into Tornado Cash and, after Tether froze assets, converted USDT to USDD via SUN.io and the USDD PSM, with part of the funds routed to a Binance hot wallet while roughly $70.6M in traced assets reportedly remains in suspect wallets.", "detailed_summary_en": "Suspects in the ~$90M Ledger distributor theft moved 430.2 ETH (~$1.07M) into Tornado Cash and, after Tether froze assets, converted USDT to USDD via SUN.io and the USDD PSM, with part of the funds routed to a Binance hot wallet while roughly $70.6M in traced assets reportedly remains in suspect wallets.", "background_zh": "Tornado Cash 是一个开源、非托管的混币协议，运行于兼容以太坊虚拟机（EVM）的网络之上，用于切断资金来源与去向地址之间的链上关联；美国财政部曾于 2022 年 8 月将其列入黑名单，2024 年 11 月美国联邦上诉法院推翻了这一裁定。USDD 的 PSM（锚定稳定模块）是 USDD 内置的固定汇率兑换功能，可在 USDD 与支持的稳定币之间按 1:1 比例兑换。", "background_en": "Tornado Cash is an open-source, non-custodial mixer on Ethereum Virtual Machine-compatible networks that obscures the link between source and destination addresses; the U.S. Treasury blacklisted it in August 2022, and a U.S. federal appeals court overturned that ruling in November 2024. The USDD PSM (Peg Stability Module) is USDD's built-in fixed-rate swap feature that converts between USDD and supported stablecoins at a 1:1 rate.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "此事显示出稳定币发行方的冻结权会推动被盗资金转向 USDD 等替代稳定币以及 Tornado Cash 等混币工具，这一路径涉及 USDT/USDD 兑换流动性以及流入 Binance 等中心化交易所热钱包的资金。据称仍留在嫌疑钱包中的约 7060 万美元资产，是后续链上资金传导的主要观察点。", "market_impact_en": "The episode illustrates how stablecoin issuer freeze powers can push stolen funds toward alternative stablecoins such as USDD and toward mixers like Tornado Cash, a channel that touches USDT/USDD swap liquidity and deposits into centralized-exchange hot wallets such as Binance's. The reported ~$70.6 million still sitting in suspect wallets is the main on-chain transmission point to watch.", "importance_score": 7.5, "references": [ { "url": "https://en.wikipedia.org/wiki/Tornado_Cash", "title": "Tornado Cash" }, { "url": "https://docs.usdd.io/psm/the-psm", "title": "The PSM | USDD Docs" }, { "url": "https://docs.usdd.io/user-guide/psm-peg-stability-module", "title": "PSM | USDD Docs" } ], "confidence": 0.95, "story_ids": [ "telegram:theblockbeats:199759" ], "sources": [ { "url": "http://sun.io/", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_da79d307f72c844d", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T16:40:29Z", "published_at": "2026-10-09T16:40:29Z", "first_seen_at": "2026-10-09T18:27:35.835620Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger 称东南亚经销商与 8600 万美元盗取事件有关", "title_en": "Ledger says Southeast Asia reseller linked to $86M draining", "what_changed_zh": "Ledger 官方确认正在调查与经销商 CryptoBilis 相关的供应链攻击，并要求 CryptoBilis 暂停所有 Ledger 设备的销售和发货；建议过去 90 天从 CryptoBilis 购买设备的用户不要进行初始化设置，若已设置则把资产转移到新的 Ledger 签名器。", "what_changed_en": "Ledger officially confirmed it is investigating a CryptoBilis-linked supply-chain compromise and told CryptoBilis to pause all sales and shipments of Ledger devices; users who bought devices from CryptoBilis in the past 90 days were advised not to initiate setup and, if already set up, to move assets to a new Ledger signer.", "current_state_zh": "Ledger 官方确认调查与经销商 CryptoBilis 相关的供应链攻击，已要求其暂停 Ledger 设备销售和发货，并建议受影响用户迁移资产到新签名器；损失估计超过 8000 万至 8600 万美元，此前链上追踪显示约 9000 万美元相关损失，Tether 已冻结部分 USDT，嫌疑人曾向 Tornado Cash 转入 430.2 ETH 并通过 SUN.io/USDD PSM 兑换 USDD；设备篡改细节与攻击者身份仍未证实。", "current_state_en": "Ledger has officially confirmed it is investigating a CryptoBilis-linked supply-chain compromise, instructed the reseller to pause Ledger device sales and shipments, and advised affected users to migrate assets to a new signer; loss estimates range above $80M–$86M, with earlier on-chain tracking indicating ~$90M in related losses, Tether freezing some USDT, and suspects moving 430.2 ETH to Tornado Cash and converting USDT to USDD via SUN.io/USDD PSM; device tampering details and attacker identity remain unconfirmed.", "detailed_summary_zh": "Ledger confirmed it is investigating a supply-chain compromise tied to Southeast Asian reseller CryptoBilis, which has been linked to over $80 million drained from users who bought Ledger devices through it, prompting advice to affected buyers to move assets to a new signer.", "detailed_summary_en": "Ledger confirmed it is investigating a supply-chain compromise tied to Southeast Asian reseller CryptoBilis, which has been linked to over $80 million drained from users who bought Ledger devices through it, prompting advice to affected buyers to move assets to a new signer.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.95, "story_ids": [ "rss:protos.com_feed_:603706f2779b95ac" ], "sources": [ { "url": "https://protos.com/ledger-says-southeast-asia-reseller-linked-to-86m-draining/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_3f0d1f28ed46e4fb", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-09T21:10:39Z", "published_at": "2026-10-09T21:10:39Z", "first_seen_at": "2026-10-09T22:30:50.383722Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger 黑客恐慌规模接近 9000 万美元，Tether 着手冻结被盗 USDT", "title_en": "Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT", "what_changed_zh": "行业人士开始公开介入调查：币安创始人赵长鹏警告用户谨慎，称事件似乎局限于单一供应商的供应链攻击；前 Mt. Gox CEO Mark Karpelès 正在调查是否有恶意硬件组件被植入发给客户的设备，并要求 CryptoBilis 打开部分未售出的 Ledger 钱包检查内部电路板。此外，报道指出 Ledger 的 Genuine Check 只能验证安全芯片，可能无法发现硬件其他部位的物理篡改。", "what_changed_en": "Industry figures publicly intervened: Binance founder Changpeng Zhao warned users and said the incident appears localized to a single-vendor supply-chain attack; former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were implanted in customer devices and asked CryptoBilis to open some unsold Ledger wallets for circuit-board inspection. Reports also note Ledger's Genuine Check verifies the Secure Element but may not detect physical modifications elsewhere in the hardware.", "current_state_zh": "Ledger 正在调查与东南亚授权经销商 CryptoBilis 相关的用户资金损失事件；Ledger 已要求 CryptoBilis 暂停销售和发货，并对过去90天内购买设备的客户发出警示。链上研究人员估计相关损失约为7200万至9000万美元，Tether 已冻结相关 USDT。赵长鹏等业内人士公开评论并呼吁行业协助追踪资金，Mark Karpelès 正调查设备是否植入恶意硬件组件，但攻击方式、设备是否被篡改及攻击者身份仍未确认，调查仍在进行中。", "current_state_en": "Ledger is investigating reported fund losses tied to Southeast Asian authorized reseller CryptoBilis; Ledger has asked CryptoBilis to suspend sales and shipments and warned customers who bought devices in the past 90 days. Onchain researchers estimate losses at roughly $72 million to $90 million, and Tether has frozen related USDT. Industry figures including Changpeng Zhao have publicly commented and called for industry help tracing funds, while Mark Karpelès is investigating whether malicious hardware components were implanted; the attack method, device tampering and attacker identity remain unconfirmed, and the investigation is ongoing.", "detailed_summary_zh": "Ledger suspended sales and shipments through Southeast Asian reseller CryptoBilis and urged recent buyers to move funds to fresh wallets, while Tether froze USDT tied to suspected thefts from Ledger customers that investigators estimate at nearly $90 million.", "detailed_summary_en": "Ledger suspended sales and shipments through Southeast Asian reseller CryptoBilis and urged recent buyers to move funds to fresh wallets, while Tether froze USDT tied to suspected thefts from Ledger customers that investigators estimate at nearly $90 million.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.92, "story_ids": [ "rss:cryptoslate.com_feed_:b3e002b0e69feb53" ], "sources": [ { "url": "https://cryptoslate.com/ledger-hack-scare-nears-90-million-as-tether-moves-to-freeze-stolen-usdt/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_43f44af694b0ab71", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-10T01:28:02Z", "published_at": "2026-10-10T01:28:02Z", "first_seen_at": "2026-10-10T02:39:24.921155Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【慢雾 CISO 推测 Ledger 设备被攻击路径：旁路录屏助记词后再外传】", "title_en": "【慢雾 CISO 推测 Ledger 设备被攻击路径：旁路录屏助记词后再外传】", "what_changed_zh": "在Mark Karpelès报告收到一台内置隐藏间谍模块的Ledger之后，SlowMist的首席信息安全官概述了一台被篡改的Ledger设备如何从屏幕的SPI数据线记录助记词，并通过嵌入式LTE/eSIM模块将其外泄。", "what_changed_en": "SlowMist's CISO outlined how a tampered Ledger device could record the mnemonic words from the screen's SPI data lines and exfiltrate them via an embedded LTE/eSIM module, following Mark Karpelès' report of receiving a Ledger with a hidden spy module.", "current_state_zh": "在Mark Karpelès报告收到一台内置隐藏间谍模块的Ledger之后，SlowMist的首席信息安全官概述了一台被篡改的Ledger设备如何从屏幕的SPI数据线记录助记词，并通过嵌入式LTE/eSIM模块将其外泄。", "current_state_en": "SlowMist's CISO outlined how a tampered Ledger device could record the mnemonic words from the screen's SPI data lines and exfiltrate them via an embedded LTE/eSIM module, following Mark Karpelès' report of receiving a Ledger with a hidden spy module.", "detailed_summary_zh": "SlowMist's CISO outlined how a tampered Ledger device could record the mnemonic words from the screen's SPI data lines and exfiltrate them via an embedded LTE/eSIM module, following Mark Karpelès' report of receiving a Ledger with a hidden spy module.", "detailed_summary_en": "SlowMist's CISO outlined how a tampered Ledger device could record the mnemonic words from the screen's SPI data lines and exfiltrate them via an embedded LTE/eSIM module, following Mark Karpelès' report of receiving a Ledger with a hidden spy module.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120070", "telegram:theblockbeats:199770" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114883", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371090?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_81baf56b6cf38449", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-10T01:42:43Z", "published_at": "2026-10-10T01:42:43Z", "first_seen_at": "2026-10-10T02:39:24.921336Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "【CryptoBilis 暂停三国全部品牌硬件钱包销售，目前正配合 Ledger 调查】", "title_en": "【CryptoBilis 暂停三国全部品牌硬件钱包销售，目前正配合 Ledger 调查】", "what_changed_zh": "CryptoBilis 已实际暂停马来西亚、菲律宾和印度尼西亚所有门店与线上渠道的全部品牌硬件钱包销售，并暂时关闭实体门店，正在配合 Ledger 调查并接受独立专家审查内部流程，预计三个工作日内公布进展。", "what_changed_en": "CryptoBilis has now suspended all hardware-wallet sales across its physical stores and online channels in Malaysia, the Philippines and Indonesia, temporarily closed physical stores, is cooperating with Ledger’s investigation and having independent experts review internal processes, with further updates expected within three business days.", "current_state_zh": "Ledger 正在调查与东南亚授权经销商 CryptoBilis 相关的用户资金损失事件；CryptoBilis 已实际暂停马来西亚、菲律宾和印度尼西亚所有门店及线上渠道的全部品牌硬件钱包销售，并暂时关闭实体门店，正在配合 Ledger 调查并由独立专家审查内部流程。Ledger 此前已要求 CryptoBilis 暂停销售和发货，并警示过去90天内购买设备的客户；链上研究人员估计相关损失约为7200万至9000万美元，Tether 已冻结相关 USDT。攻击方式、设备是否被篡改及攻击者身份仍未确认，调查仍在进行中。", "current_state_en": "Ledger is investigating reported fund losses tied to Southeast Asian authorized reseller CryptoBilis; CryptoBilis has now suspended all brand hardware-wallet sales in its physical stores and online channels in Malaysia, the Philippines and Indonesia, temporarily closed physical stores, and is cooperating with Ledger’s investigation while independent experts review its processes. Ledger had already asked CryptoBilis to suspend sales and shipments and warned customers who bought devices in the past 90 days. Onchain researchers estimate losses at roughly $72 million to $90 million, and Tether has frozen related USDT. The attack method, device tampering and attacker identity remain unconfirmed, and the investigation is ongoing.", "detailed_summary_zh": "CryptoBilis suspended all hardware-wallet sales and closed physical stores across Malaysia, the Philippines, and Indonesia while cooperating with a Ledger investigation, warning customers not to activate units bought from its channels and to move assets to Ledger devices using newly generated mnemonics.", "detailed_summary_en": "CryptoBilis suspended all hardware-wallet sales and closed physical stores across Malaysia, the Philippines, and Indonesia while cooperating with a Ledger investigation, warning customers not to activate units bought from its channels and to move assets to Ledger devices using newly generated mnemonics.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.92, "story_ids": [ "telegram:foresightnews:120071" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114884", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_20d76fa8c70416f1", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-10T02:57:40Z", "published_at": "2026-10-10T02:57:40Z", "first_seen_at": "2026-10-10T06:40:40.288581Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "BlockBeats pinned «📌律动10.10焦点关注 🔴Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT 🟠Le", "title_en": "BlockBeats pinned «📌律动10.10焦点关注 🔴Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT 🟠Le", "what_changed_zh": "一起损失接近9000万美元的Ledger硬件钱包被攻破事件正浮现出新的取证细节——疑似供应商一侧的硬件植入被用于提取助记词、经销商CryptoBilis在3月发生所有权变更，以及Tether冻结了与攻击者相关地址中的大量USDT。", "what_changed_en": "A Ledger hardware-wallet compromise with losses near $90 million is drawing new forensic detail — a suspected supplier-side hardware implant used to extract seed phrases, distributor CryptoBilis's March ownership change, and Tether freezing substantial USDT in attacker-linked addresses.", "current_state_zh": "一起损失接近9000万美元的Ledger硬件钱包被攻破事件正浮现出新的取证细节——疑似供应商一侧的硬件植入被用于提取助记词、经销商CryptoBilis在3月发生所有权变更，以及Tether冻结了与攻击者相关地址中的大量USDT。", "current_state_en": "A Ledger hardware-wallet compromise with losses near $90 million is drawing new forensic detail — a suspected supplier-side hardware implant used to extract seed phrases, distributor CryptoBilis's March ownership change, and Tether freezing substantial USDT in attacker-linked addresses.", "detailed_summary_zh": "A Ledger hardware-wallet compromise with losses near $90 million is drawing new forensic detail — a suspected supplier-side hardware implant used to extract seed phrases, distributor CryptoBilis's March ownership change, and Tether freezing substantial USDT in attacker-linked addresses.", "detailed_summary_en": "A Ledger hardware-wallet compromise with losses near $90 million is drawing new forensic detail — a suspected supplier-side hardware implant used to extract seed phrases, distributor CryptoBilis's March ownership change, and Tether freezing substantial USDT in attacker-linked addresses.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199783", "telegram:theblockbeats:199802" ], "sources": [ { "url": "https://telegram.me/theblockbeats/199783", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/news/63863?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_4891dbfe5bd2d6e2", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-10T09:19:02Z", "published_at": "2026-10-10T09:19:02Z", "first_seen_at": "2026-10-10T10:44:34.609154Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "⚡️OneKey分析Ledger硬件供应链攻击路径，提出硬件钱包五项改进措施", "title_en": "⚡️OneKey分析Ledger硬件供应链攻击路径，提出硬件钱包五项改进措施", "what_changed_zh": "在通过CryptoBilis销售的Ledger设备疑似被篡改、导致约9000万美元资产被盗后，OneKey发布了对该硬件供应链攻击路径的分析，并宣布五项硬件钱包改进，包括升级防篡改包装、无屏幕初始化流程，以及内部主板总线通信的固件/硬件级加密。", "what_changed_en": "Following the suspected tampering of Ledger devices sold through CryptoBilis that led to roughly $90M in stolen assets, OneKey published an analysis of the hardware supply-chain attack path and announced five hardware-wallet improvements, including upgraded anti-tamper packaging, a screenless initialization flow, and firmware/hardware-level encryption of internal mainboard bus communications.", "current_state_zh": "在通过CryptoBilis销售的Ledger设备疑似被篡改、导致约9000万美元资产被盗后，OneKey发布了对该硬件供应链攻击路径的分析，并宣布五项硬件钱包改进，包括升级防篡改包装、无屏幕初始化流程，以及内部主板总线通信的固件/硬件级加密。", "current_state_en": "Following the suspected tampering of Ledger devices sold through CryptoBilis that led to roughly $90M in stolen assets, OneKey published an analysis of the hardware supply-chain attack path and announced five hardware-wallet improvements, including upgraded anti-tamper packaging, a screenless initialization flow, and firmware/hardware-level encryption of internal mainboard bus communications.", "detailed_summary_zh": "Following the suspected tampering of Ledger devices sold through CryptoBilis that led to roughly $90M in stolen assets, OneKey published an analysis of the hardware supply-chain attack path and announced five hardware-wallet improvements, including upgraded anti-tamper packaging, a screenless initialization flow, and firmware/hardware-level encryption of internal mainboard bus communications.", "detailed_summary_en": "Following the suspected tampering of Ledger devices sold through CryptoBilis that led to roughly $90M in stolen assets, OneKey published an analysis of the hardware supply-chain attack path and announced five hardware-wallet improvements, including upgraded anti-tamper packaging, a screenless initialization flow, and firmware/hardware-level encryption of internal mainboard bus communications.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199825" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371149?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_b831a0d45f8e0d50", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-10T10:00:20Z", "published_at": "2026-10-10T10:00:20Z", "first_seen_at": "2026-10-10T10:44:32.597884Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "“自托管将很快消亡”——Ledger钱包被盗案损失达9100万美元", "title_en": "‘Self-custody will die very quickly’ – Ledger wallet theft hits $91M", "what_changed_zh": "一起与Ledger相关的钱包被盗案损失约9100万美元，重新引发了对硬件钱包安全性的争论，批评者认为该事件削弱了自托管模式。", "what_changed_en": "A Ledger-related wallet theft totaling about $91M has renewed debate over hardware-wallet security, with critics arguing the incident undermines the self-custody model.", "current_state_zh": "一起与Ledger相关的钱包被盗案损失约9100万美元，重新引发了对硬件钱包安全性的争论，批评者认为该事件削弱了自托管模式。", "current_state_en": "A Ledger-related wallet theft totaling about $91M has renewed debate over hardware-wallet security, with critics arguing the incident undermines the self-custody model.", "detailed_summary_zh": "A Ledger-related wallet theft totaling about $91M has renewed debate over hardware-wallet security, with critics arguing the incident undermines the self-custody model.", "detailed_summary_en": "A Ledger-related wallet theft totaling about $91M has renewed debate over hardware-wallet security, with critics arguing the incident undermines the self-custody model.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:f213567922600bb2", "telegram:wublockchainenglish:26356" ], "sources": [ { "url": "https://ambcrypto.com/self-custody-will-die-very-quickly-ledger-wallet-theft-hits-91m/", "label": "AMBCrypto", "source_type": "google_news", "official": false }, { "url": "https://wublockchain.xyz/news/news-21183", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_ced0b2dc414f82a1", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-10T17:15:58Z", "published_at": "2026-10-10T17:15:58Z", "first_seen_at": "2026-10-10T17:25:32.225755Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Ledger称受影响用户的设备含有硬件植入物", "title_en": "Ledger Says Affected User’s Device Contained Hardware Implant", "what_changed_zh": "Ledger已确认一名受影响用户的设备中含有硬件植入物，促使经销商CryptoBilis暂停其全部硬件钱包库存的销售，供应链调查仍在进行中。", "what_changed_en": "Ledger has confirmed that an affected user's device contained a hardware implant, prompting reseller CryptoBilis to suspend sales of its entire hardware wallet inventory while the supply-chain investigation proceeds.", "current_state_zh": "Ledger已确认一名受影响用户的设备中含有硬件植入物，促使经销商CryptoBilis暂停其全部硬件钱包库存的销售，供应链调查仍在进行中。", "current_state_en": "Ledger has confirmed that an affected user's device contained a hardware implant, prompting reseller CryptoBilis to suspend sales of its entire hardware wallet inventory while the supply-chain investigation proceeds.", "detailed_summary_zh": "Ledger has confirmed that an affected user's device contained a hardware implant, prompting reseller CryptoBilis to suspend sales of its entire hardware wallet inventory while the supply-chain investigation proceeds.", "detailed_summary_en": "Ledger has confirmed that an affected user's device contained a hardware implant, prompting reseller CryptoBilis to suspend sales of its entire hardware wallet inventory while the supply-chain investigation proceeds.", "background_zh": "Ledger 已就与东南亚经销商 CryptoBilis 所售设备相关的钱包被盗事件展开调查，并于 10 月 9 日要求该经销商暂停销售。CryptoBilis 前联合创始人证实公司已于今年 3 月被收购，创始团队退出所有运营、管理及行政职务，并表示“我们已不再是公司的一部分”。包括 SlowMist 首席信息安全官和 Mark Karpelès 在内的安全研究人员描述了旨在窃取助记词的植入模块；Karpelès 称固件无法检测该攻击，因为模块仅在屏幕刷新时进行监听。", "background_en": "Ledger opened an investigation into wallet drains tied to devices sold by Southeast Asian reseller CryptoBilis and on October 9 asked the reseller to pause sales. CryptoBilis's former co-founder confirmed the company was acquired in March and said the founding team exited all operational, management and administrative roles, adding that they are \"no longer part of the company.\" Security researchers, including SlowMist's CISO and Mark Karpelès, have described implants designed to capture seed phrases, with Karpelès saying firmware cannot detect the attack because the module only listens when the screen refreshes.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "已确认的植入模块直接冲击东南亚自托管硬件的经销渠道，依赖 CryptoBilis 分销设备的用户面临的是托管与资产安全风险，而非交易所层面的风险。此事也会加剧对硬件钱包供应链验证的审视，可能影响用户通过第三方经销商与官方直营渠道购买设备的偏好结构。", "market_impact_en": "The confirmed implant hits the reseller channel for self-custody hardware in Southeast Asia, where buyers relying on CryptoBilis-distributed devices face custody and asset-security exposure rather than exchange-level risk. It also feeds broader scrutiny of hardware wallet supply-chain verification, which could affect demand patterns for devices bought through third-party resellers versus direct channels.", "importance_score": 8.0, "references": [ { "url": "https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163", "title": "Ledger investigates wallet drains involving CryptoBilis... | The Block" }, { "url": "https://bitquery.io/investigations/ledger-cryptobilis-hack", "title": "Ledger CryptoBilis Hack: $93.2M Drained, Where It Went - Bitquery" }, { "url": "https://gizmodo.com/ledgers-crypto-wallets-reportedly-backdoored-71-million-in-crypto-already-moved-2000824372", "title": "Ledger's Crypto Wallets Reportedly Backdoored, $71 Million in Crypto..." } ], "confidence": 0.75, "story_ids": [ "rss:thedefiant.io_api_feed:1e330bf9141dcc72", "telegram:theblockbeats:199864" ], "sources": [ { "url": "https://thedefiant.io/news/hacks/ledger-says-affected-user-s-device-contained-hardware-implant", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://m.theblockbeats.info/flash/371189?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_c11503989d708aac", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T01:25:17Z", "published_at": "2026-10-11T01:25:17Z", "first_seen_at": "2026-10-11T02:07:45.140443Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【Ledger 确认一用户设备遭硬件植入，经销商 CryptoBilis 已停售硬件钱包】", "title_en": "【Ledger 确认一用户设备遭硬件植入，经销商 CryptoBilis 已停售硬件钱包】", "what_changed_zh": "Ledger 确认一名用户从经销商 CryptoBilis 处购买的设备中存在未经授权的硬件植入，该公司已暂停所有硬件钱包销售，同时调查人员和 SEAL 911 正在调查一起盗窃计划，该计划从以太坊、TRON 和比特币上的受害者钱包中盗走了超过 8600 万美元。", "what_changed_en": "Ledger confirmed an unauthorized hardware implant in one user's device bought from reseller CryptoBilis, which has halted all hardware wallet sales while investigators and SEAL 911 probe a theft scheme that drained over $86 million from victim wallets on Ethereum, TRON and Bitcoin.", "current_state_zh": "Ledger 确认一名用户从经销商 CryptoBilis 处购买的设备中存在未经授权的硬件植入，该公司已暂停所有硬件钱包销售，同时调查人员和 SEAL 911 正在调查一起盗窃计划，该计划从以太坊、TRON 和比特币上的受害者钱包中盗走了超过 8600 万美元。", "current_state_en": "Ledger confirmed an unauthorized hardware implant in one user's device bought from reseller CryptoBilis, which has halted all hardware wallet sales while investigators and SEAL 911 probe a theft scheme that drained over $86 million from victim wallets on Ethereum, TRON and Bitcoin.", "detailed_summary_zh": "Ledger confirmed an unauthorized hardware implant in one user's device bought from reseller CryptoBilis, which has halted all hardware wallet sales while investigators and SEAL 911 probe a theft scheme that drained over $86 million from victim wallets on Ethereum, TRON and Bitcoin.", "detailed_summary_en": "Ledger confirmed an unauthorized hardware implant in one user's device bought from reseller CryptoBilis, which has halted all hardware wallet sales while investigators and SEAL 911 probe a theft scheme that drained over $86 million from victim wallets on Ethereum, TRON and Bitcoin.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120109", "google_news:article:0fc25814287c89b4", "telegram:theblockbeats:199899" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114919", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://www.binance.com/en/square/post/376003068866241", "label": "Binance", "source_type": "google_news", "official": false }, { "url": "https://m.theblockbeats.info/flash/371225?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_3cb606cc0db58eec", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T03:20:24Z", "published_at": "2026-10-11T03:20:24Z", "first_seen_at": "2026-10-11T15:01:20.572357Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger确认受影响用户设备中存在未经授权的硬件植入物，CryptoBilis停止销售", "title_en": "Ledger Confirms Unauthorized Hardware Implant in Impacted User's Device as CryptoBilis Halts Sales", "what_changed_zh": "Ledger确认一名受影响用户的设备中被植入了未经授权的硬件植入物，促使经销商CryptoBilis停止销售受影响的硬件。", "what_changed_en": "Ledger confirmed that an impacted user's device contained an unauthorized hardware implant, prompting reseller CryptoBilis to halt sales of the affected hardware.", "current_state_zh": "Ledger确认一名受影响用户的设备中被植入了未经授权的硬件植入物，促使经销商CryptoBilis停止销售受影响的硬件。", "current_state_en": "Ledger confirmed that an impacted user's device contained an unauthorized hardware implant, prompting reseller CryptoBilis to halt sales of the affected hardware.", "detailed_summary_zh": "Ledger confirmed that an impacted user's device contained an unauthorized hardware implant, prompting reseller CryptoBilis to halt sales of the affected hardware.", "detailed_summary_en": "Ledger confirmed that an impacted user's device contained an unauthorized hardware implant, prompting reseller CryptoBilis to halt sales of the affected hardware.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:a9703b9a55918ad3" ], "sources": [ { "url": "https://www.binance.com/en-ZA/square/post/376003068866241", "label": "Binance", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_8aae09e41a9d5b54", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T09:01:51Z", "published_at": "2026-10-11T09:01:51Z", "first_seen_at": "2026-10-11T10:20:51.336296Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger 确认存在未经授权的硬件植入物；损失可能超过 8600 万美元", "title_en": "Ledger confirms unauthorized hardware implant; losses may exceed $86M", "what_changed_zh": "Ledger 确认，从东南亚经销商 CryptoBilis 处购买的一台设备含有未经授权的硬件植入物，这是对用户损失估计超过 8600 万美元的调查的一部分，该经销商已暂停所有硬件钱包销售。", "what_changed_en": "Ledger confirmed that a device bought from Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, part of an investigation into user losses estimated at over $86 million, with the reseller suspending all hardware wallet sales.", "current_state_zh": "Ledger 确认，从东南亚经销商 CryptoBilis 处购买的一台设备含有未经授权的硬件植入物，这是对用户损失估计超过 8600 万美元的调查的一部分，该经销商已暂停所有硬件钱包销售。", "current_state_en": "Ledger confirmed that a device bought from Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, part of an investigation into user losses estimated at over $86 million, with the reseller suspending all hardware wallet sales.", "detailed_summary_zh": "Ledger confirmed that a device bought from Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, part of an investigation into user losses estimated at over $86 million, with the reseller suspending all hardware wallet sales.", "detailed_summary_en": "Ledger confirmed that a device bought from Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, part of an investigation into user losses estimated at over $86 million, with the reseller suspending all hardware wallet sales.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:cointelegraph.com_rss:6af420fb10cc63f2" ], "sources": [ { "url": "https://cointelegraph.com/news/ledger-confirms-unauthorized-hardware-implant-losses-may-exceed-86m?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_08c4c0bda2662107", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T09:45:02Z", "published_at": "2026-10-11T09:45:02Z", "first_seen_at": "2026-10-11T10:20:45.013264Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "高风险Ledger经销商名单披露，CryptoBilis事件后区域供应链风险引发关注", "title_en": "高风险Ledger经销商名单披露，CryptoBilis事件后区域供应链风险引发关注", "what_changed_zh": "在 Ledger 确认东南亚经销商 CryptoBilis 销售的设备含有未经授权的硬件植入物后，一位分析师发布了一份推测性的观察名单，列出区域内相邻的 Ledger 经销商，其供应链可能也受到影响，并敦促受影响的买家将资产转移到安全的地方。", "what_changed_en": "After Ledger confirmed that Southeast Asian distributor CryptoBilis sold devices containing unauthorized hardware implants, an analyst published a speculative watch list of regionally adjacent Ledger resellers whose supply chains may also be affected, urging affected buyers to move assets to safety.", "current_state_zh": "在 Ledger 确认东南亚经销商 CryptoBilis 销售的设备含有未经授权的硬件植入物后，一位分析师发布了一份推测性的观察名单，列出区域内相邻的 Ledger 经销商，其供应链可能也受到影响，并敦促受影响的买家将资产转移到安全的地方。", "current_state_en": "After Ledger confirmed that Southeast Asian distributor CryptoBilis sold devices containing unauthorized hardware implants, an analyst published a speculative watch list of regionally adjacent Ledger resellers whose supply chains may also be affected, urging affected buyers to move assets to safety.", "detailed_summary_zh": "After Ledger confirmed that Southeast Asian distributor CryptoBilis sold devices containing unauthorized hardware implants, an analyst published a speculative watch list of regionally adjacent Ledger resellers whose supply chains may also be affected, urging affected buyers to move assets to safety.", "detailed_summary_en": "After Ledger confirmed that Southeast Asian distributor CryptoBilis sold devices containing unauthorized hardware implants, an analyst published a speculative watch list of regionally adjacent Ledger resellers whose supply chains may also be affected, urging affected buyers to move assets to safety.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199900" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371226?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_3d60bff6fb0e278b", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T10:20:43Z", "published_at": "2026-10-11T10:20:43Z", "first_seen_at": "2026-10-11T10:57:28.832136Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger 确认存在硬件植入攻击，称系统未被入侵", "title_en": "Ledger confirms hardware implant attack, says systems not breached", "what_changed_zh": "Ledger 表示其自身系统未被入侵，植入物来自物理篡改；并建议受影响用户不要初始化未使用设备，将资产转移到使用新恢复短语创建的钱包。", "what_changed_en": "Ledger said its own systems were not breached and the implant resulted from physical tampering; it advised affected users not to initialize unused devices and to move assets to wallets created with new recovery phrases.", "current_state_zh": "Ledger 确认受影响设备含未经授权的硬件植入物（物理篡改），称自身系统未被入侵；经销商 CryptoBilis 已暂停硬件钱包销售，Ledger 建议受影响用户不要初始化未使用设备并将资产转移到新恢复短语钱包，链上损失估计超过 8600 万美元。", "current_state_en": "Ledger confirmed an affected device contained an unauthorized hardware implant from physical tampering and said its own systems were not breached; reseller CryptoBilis has suspended hardware wallet sales, and Ledger advised affected users not to initialize unused devices and to move assets to wallets with new recovery phrases, with on-chain losses estimated above $86 million.", "detailed_summary_zh": "Ledger confirmed that an affected device contained an unauthorized hardware implant from physical tampering, while saying its own systems were not breached, prompting distributor CryptoBilis to suspend hardware wallet sales and Ledger to advise affected users against initializing unused devices and to migrate assets to wallets with new recovery phrases, with on-chain losses from the incident estimated above $86 million.", "detailed_summary_en": "Ledger confirmed that an affected device contained an unauthorized hardware implant from physical tampering, while saying its own systems were not breached, prompting distributor CryptoBilis to suspend hardware wallet sales and Ledger to advise affected users against initializing unused devices and to migrate assets to wallets with new recovery phrases, with on-chain losses from the incident estimated above $86 million.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.93, "story_ids": [ "telegram:wublockchainenglish:26365" ], "sources": [ { "url": "https://wublockchain.xyz/news/ledger-confirms-hardware-implant-attack-systems-not-breached-21192", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_b29b3a36e49d2089", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T15:10:38Z", "published_at": "2026-10-11T15:10:38Z", "first_seen_at": "2026-10-11T17:44:38.636010Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "【Ledger 供应链攻击据报扩展至欧洲，官方经销商售出硬件钱包发现间谍植入装置】", "title_en": "【Ledger 供应链攻击据报扩展至欧洲，官方经销商售出硬件钱包发现间谍植入装置】", "what_changed_zh": "数周前从欧洲官方经销商处购买的一台Ledger硬件钱包被发现含有未经授权的间谍植入物，其可疑接线在正品设备中并不存在，表明销售前曾遭物理篡改，目前亚洲、南美和欧洲均报告了疑似案例，迄今尚无资金被盗。", "what_changed_en": "A Ledger hardware wallet bought weeks earlier from an official European reseller was found to contain an unauthorized spy implant with suspicious wiring not present in genuine units, indicating physical tampering before sale, with suspected cases now reported across Asia, South America and Europe and no funds stolen so far.", "current_state_zh": "数周前从欧洲官方经销商处购买的一台Ledger硬件钱包被发现含有未经授权的间谍植入物，其可疑接线在正品设备中并不存在，表明销售前曾遭物理篡改，目前亚洲、南美和欧洲均报告了疑似案例，迄今尚无资金被盗。", "current_state_en": "A Ledger hardware wallet bought weeks earlier from an official European reseller was found to contain an unauthorized spy implant with suspicious wiring not present in genuine units, indicating physical tampering before sale, with suspected cases now reported across Asia, South America and Europe and no funds stolen so far.", "detailed_summary_zh": "A Ledger hardware wallet bought weeks earlier from an official European reseller was found to contain an unauthorized spy implant with suspicious wiring not present in genuine units, indicating physical tampering before sale, with suspected cases now reported across Asia, South America and Europe and no funds stolen so far.", "detailed_summary_en": "A Ledger hardware wallet bought weeks earlier from an official European reseller was found to contain an unauthorized spy implant with suspicious wiring not present in genuine units, indicating physical tampering before sale, with suspected cases now reported across Asia, South America and Europe and no funds stolen so far.", "background_zh": "10 月 9 日，Ledger 表示正在调查与东南亚经销商所售设备相关的资金被盗报告，同期分析机构追踪到数千万美元规模的疑似资金流出，Ledger 要求 CryptoBilis 暂停所有销售和发货。CryptoBilis 被列为 Ledger 在印度尼西亚、马来西亚和菲律宾的官方经销商。", "background_en": "On October 9, Ledger said it was investigating reports of stolen funds linked to devices sold through a Southeast Asian reseller, while analysts tracked tens of millions of dollars in suspected drains and Ledger asked CryptoBilis to pause all sales and shipments. CryptoBilis is listed as an official Ledger reseller for Indonesia, Malaysia and the Philippines.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件影响自托管硬件钱包这一细分领域：若通过第三方经销商购买的设备可能携带可绕过标准验证的植入装置，风险认知将转向官方直购渠道，并可能影响经销商渠道的硬件钱包需求，进而波及更广泛的自托管安全叙事。", "market_impact_en": "The report bears on the self-custody hardware-wallet segment: if devices bought through third-party resellers can carry implants that defeat standard attestation checks, risk perception shifts toward direct-from-vendor purchasing and can affect demand for wallets distributed through reseller channels, feeding into the broader self-custody security narrative.", "importance_score": 8.0, "references": [ { "url": "https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen", "title": "Ledger investigates potential wallet tampering after reports of $86..." }, { "url": "https://bitquery.io/investigations/ledger-cryptobilis-hack", "title": "Ledger CryptoBilis Hack: $92.9M Drained, Where It Went - Bitquery" }, { "url": "https://www.ledger.com/academy/topics/ledgersolutions/best-practices-to-securely-buy-ledger-signer", "title": "Best Practices To Securely Buy Your Ledger Signer | Ledger" } ], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120136", "rss:thedefiant.io_api_feed:454da4af471dbab3" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114942", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://thedefiant.io/news/security/ledger-user-reports-hardware-implant-in-wallet-bought-in-europe", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_a21821131784c650", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-11T17:18:19Z", "published_at": "2026-10-11T17:18:19Z", "first_seen_at": "2026-10-11T17:44:43.308972Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger称所有已确认的盗取案件均涉及CryptoBilis销售的设备", "title_en": "Ledger Says All Confirmed Draining Cases Involve CryptoBilis-Sold Devices", "what_changed_zh": "Ledger表示，所有已确认的钱包盗取案件均可追溯到经销商CryptoBilis销售的设备，并称其自有直销渠道未受影响，同时警告经销商切勿将退回的产品重新上架。", "what_changed_en": "Ledger says every confirmed wallet-draining case traces back to devices sold by reseller CryptoBilis, stating its own direct sales channels are unaffected and warning resellers never to restock returned products.", "current_state_zh": "Ledger表示，所有已确认的钱包盗取案件均可追溯到经销商CryptoBilis销售的设备，并称其自有直销渠道未受影响，同时警告经销商切勿将退回的产品重新上架。", "current_state_en": "Ledger says every confirmed wallet-draining case traces back to devices sold by reseller CryptoBilis, stating its own direct sales channels are unaffected and warning resellers never to restock returned products.", "detailed_summary_zh": "Ledger says every confirmed wallet-draining case traces back to devices sold by reseller CryptoBilis, stating its own direct sales channels are unaffected and warning resellers never to restock returned products.", "detailed_summary_en": "Ledger says every confirmed wallet-draining case traces back to devices sold by reseller CryptoBilis, stating its own direct sales channels are unaffected and warning resellers never to restock returned products.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:thedefiant.io_api_feed:6e29208a71aacf0f", "telegram:theblockbeats:199923", "telegram:foresightnews:120141", "rss:www.coindesk.com_arc_outboundfeeds_rss_:f017f9a5ad7b4f86" ], "sources": [ { "url": "https://thedefiant.io/news/hacks/ledger-says-all-confirmed-draining-cases-involve-cryptobilis-sold-devices", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://m.theblockbeats.info/flash/371249?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/114947", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://www.coindesk.com/tech/2026/10/12/ledger-says-unauthorized-implant-found-in-at-least-one-device-sold-by-cryptobilis", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_46cb694f82c09bb5", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T05:57:02Z", "published_at": "2026-10-12T05:57:02Z", "first_seen_at": "2026-10-12T06:40:38.472978Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "OneKey宣布停止新增经销商，并为CryptoBilis渠道购买的用户免费更换硬件钱包", "title_en": "OneKey宣布停止新增经销商，并为CryptoBilis渠道购买的用户免费更换硬件钱包", "what_changed_zh": "OneKey 已撤销 CryptoBilis 的授权经销商资格，停止新增分销商任命，并将为 3 月 1 日至公告日期间通过 CryptoBilis 购买的任何 OneKey 硬件钱包免费更换，此前该渠道流出的被篡改 Ledger 设备被指与用户资产被盗有关。", "what_changed_en": "OneKey has revoked CryptoBilis's authorized-reseller status, halted new distributor appointments, and will replace for free any OneKey hardware wallet bought through CryptoBilis between March 1 and the announcement date, after tampered Ledger devices from that channel were tied to user asset thefts.", "current_state_zh": "OneKey 已撤销 CryptoBilis 的授权经销商资格，停止新增分销商任命，并将为 3 月 1 日至公告日期间通过 CryptoBilis 购买的任何 OneKey 硬件钱包免费更换，此前该渠道流出的被篡改 Ledger 设备被指与用户资产被盗有关。", "current_state_en": "OneKey has revoked CryptoBilis's authorized-reseller status, halted new distributor appointments, and will replace for free any OneKey hardware wallet bought through CryptoBilis between March 1 and the announcement date, after tampered Ledger devices from that channel were tied to user asset thefts.", "detailed_summary_zh": "OneKey has revoked CryptoBilis's authorized-reseller status, halted new distributor appointments, and will replace for free any OneKey hardware wallet bought through CryptoBilis between March 1 and the announcement date, after tampered Ledger devices from that channel were tied to user asset thefts.", "detailed_summary_en": "OneKey has revoked CryptoBilis's authorized-reseller status, halted new distributor appointments, and will replace for free any OneKey hardware wallet bought through CryptoBilis between March 1 and the announcement date, after tampered Ledger devices from that channel were tied to user asset thefts.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:199988" ], "sources": [ { "url": "http://help.onekey.so/", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_da240b3c9f9974ce", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T06:00:34Z", "published_at": "2026-10-12T06:00:34Z", "first_seen_at": "2026-10-12T06:40:40.427325Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Ledger 钱包植入事件暴露其真伪验证漏洞", "title_en": "Ledger wallet implant exposes a gap in its authenticity check", "what_changed_zh": "独立调查将疑似盗损估计更新为约9320万美元、涉及六条链上315个钱包，并披露Ledger Genuine Check仅验证安全元件，无法检测安全元件仍完好的物理植入；Tibane Labs还记录了三代Nano X植入物，但其样本购自日本市场而非CryptoBilis。", "what_changed_en": "Independent investigators updated the suspected theft estimate to about $93.2 million across 315 wallets on six chains, and disclosed that Ledger's Genuine Check only verifies the secure element and cannot detect physical implants when that element remains intact; Tibane Labs also documented three generations of Nano X implants, though its specimens came from Japanese marketplaces rather than CryptoBilis.", "current_state_zh": "Ledger硬件钱包供应链植入事件仍在调查中：Ledger确认一名受影响用户的设备存在未经授权的硬件植入，CryptoBilis已暂停所有硬件钱包销售；独立估计称疑似盗损约9320万美元，涉及六条链上315个钱包，而Genuine Check仅能验证安全元件，无法识别保持安全元件完好的物理植入。", "current_state_en": "The Ledger hardware wallet supply chain implant incident remains under investigation: Ledger confirmed an unauthorized hardware implant in one affected user's device, CryptoBilis has suspended all hardware wallet sales, and independent estimates put suspected losses at about $93.2 million across 315 wallets on six chains, while Genuine Check only verifies the secure element and cannot detect physical implants that leave it intact.", "detailed_summary_zh": "Ledger has confirmed an unauthorized hardware implant in one affected customer's wallet — a case that exposes a blind spot in its Genuine Check authenticity verification that only attests the secure element — while independent investigators estimate $93.2M in suspected thefts across 315 wallets on six chains and authorized reseller CryptoBilis suspends all hardware wallet sales pending the investigation.", "detailed_summary_en": "Ledger has confirmed an unauthorized hardware implant in one affected customer's wallet — a case that exposes a blind spot in its Genuine Check authenticity verification that only attests the secure element — while independent investigators estimate $93.2M in suspected thefts across 315 wallets on six chains and authorized reseller CryptoBilis suspends all hardware wallet sales pending the investigation.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.92, "story_ids": [ "rss:cryptoslate.com_feed_:17ee368d8df9da1e" ], "sources": [ { "url": "https://cryptoslate.com/ledger-confirms-hidden-implant-in-crypto-wallet-as-93-million-theft-investigation-widens/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_8e8a7ed40fce44ee", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T07:44:31Z", "published_at": "2026-10-12T07:44:31Z", "first_seen_at": "2026-10-12T10:40:57.621778Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "CZ称黑客收购CryptoBilis，Ledger正调查钱包盗刷事件", "title_en": "CZ Alleges Hackers Bought CryptoBilis as Ledger Probes Wallet Drains", "what_changed_zh": "CZ称黑客收购了Ledger经销商CryptoBilis，同时Ledger正在调查钱包盗刷事件，该经销商的前创始人表示，他们于3月根据一项协议移交了运营，该协议将公开披露推迟至10月中旬。", "what_changed_en": "CZ alleges that hackers acquired Ledger reseller CryptoBilis, while Ledger investigates wallet drains, with the reseller's former founders saying they handed over operations in March under an agreement that delayed public disclosure until mid-October.", "current_state_zh": "CZ称黑客收购了Ledger经销商CryptoBilis，同时Ledger正在调查钱包盗刷事件，该经销商的前创始人表示，他们于3月根据一项协议移交了运营，该协议将公开披露推迟至10月中旬。", "current_state_en": "CZ alleges that hackers acquired Ledger reseller CryptoBilis, while Ledger investigates wallet drains, with the reseller's former founders saying they handed over operations in March under an agreement that delayed public disclosure until mid-October.", "detailed_summary_zh": "CZ alleges that hackers acquired Ledger reseller CryptoBilis, while Ledger investigates wallet drains, with the reseller's former founders saying they handed over operations in March under an agreement that delayed public disclosure until mid-October.", "detailed_summary_en": "CZ alleges that hackers acquired Ledger reseller CryptoBilis, while Ledger investigates wallet drains, with the reseller's former founders saying they handed over operations in March under an agreement that delayed public disclosure until mid-October.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:thedefiant.io_api_feed:b4d651b1852d1e2f" ], "sources": [ { "url": "https://thedefiant.io/news/security/cz-alleges-hackers-bought-cryptobilis-as-ledger-probes-wallet-drains", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_b66b23853df2e1a5", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T12:01:53Z", "published_at": "2026-10-12T12:01:53Z", "first_seen_at": "2026-10-12T12:18:08.156818Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Ledger称CryptoBilis案件影响有限，已追踪到高达9300万美元，冻结1000万美元", "title_en": "Ledger claims CryptoBilis cases are limited as up to $93M is traced, $10M frozen", "what_changed_zh": "Tether冻结了与Ledger硬件钱包盗取事件相关的1000万美元USDT；Bitquery称截至10月11日约8100万美元仍可在链上追踪，部分资金已通过Tornado Cash和Zcash转移；YFarmX给出更高估计，称9450万美元来自521个地址、跨越七个区块链。", "what_changed_en": "Tether froze $10 million in USDT tied to the Ledger hardware-wallet thefts; Bitquery said about $81 million was still traceable onchain as of Oct. 11 with some funds moved through Tornado Cash and Zcash; YFarmX gave a higher estimate of $94.5 million from 521 addresses across seven blockchains.", "current_state_zh": "Ledger硬件钱包供应链植入与盗取事件仍在调查中：Ledger确认至少一台设备存在未经授权的硬件植入，并称已确认案件均限于CryptoBilis销售的设备；独立估计在约9320万美元（315个钱包、六条链）至9450万美元（521个地址、七条链）之间，Tether已冻结1000万美元USDT，约8100万美元仍可在链上追踪，部分资金经Tornado Cash和Zcash转移；Ledger建议CryptoBilis客户不要初始化未使用设备，已使用设备的用户应转移到使用新恢复短语的新设备。", "current_state_en": "The Ledger hardware-wallet supply-chain implant and theft incident remains under investigation: Ledger confirmed an unauthorized hardware implant in at least one device and says all confirmed cases involve devices sold by CryptoBilis; independent estimates range from about $93.2 million across 315 wallets on six chains to $94.5 million across 521 addresses on seven chains, Tether has frozen $10 million in USDT, about $81 million remains traceable onchain, and some funds moved through Tornado Cash and Zcash; Ledger advised CryptoBilis customers not to set up unused devices and told those already using one to move assets to a new device with a newly generated recovery phrase.", "detailed_summary_zh": "Ledger says confirmed CryptoBilis-linked compromises are limited while investigators trace as much as $93.2M in stolen crypto from affected hardware wallets and Tether freezes $10M in USDT, urging customers to avoid unused devices and migrate funds to newly generated recovery phrases.", "detailed_summary_en": "Ledger says confirmed CryptoBilis-linked compromises are limited while investigators trace as much as $93.2M in stolen crypto from affected hardware wallets and Tether freezes $10M in USDT, urging customers to avoid unused devices and migrate funds to newly generated recovery phrases.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.9, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:ab0112ebd3d26677", "telegram:foresightnews:120209" ], "sources": [ { "url": "https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/115007", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_1fca5e85f050eb29", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T12:25:19Z", "published_at": "2026-10-12T12:25:19Z", "first_seen_at": "2026-10-12T16:21:01.980570Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitquery称与CryptoBilis相关的钱包盗刷事件中1000万美元被冻结", "title_en": "Bitquery Says $10 Million Frozen in CryptoBilis-Linked Wallet Drains", "what_changed_zh": "Bitquery 估计 CryptoBilis 相关钱包盗取事件在六条链上造成 9320 万美元损失，约 1000 万美元被冻结；Ledger 最新更新未向受影响买家提供赔偿计划。", "what_changed_en": "Bitquery estimates $93.2 million in losses across six chains from CryptoBilis-linked wallet drains, with about $10 million frozen; Ledger's latest update offers no repayment plan for affected buyers.", "current_state_zh": "Bitquery 估计 CryptoBilis 相关钱包盗取事件在六条链上造成 9320 万美元损失，约 1000 万美元被冻结，Ledger 正在调查且未向受影响买家提供赔偿计划。", "current_state_en": "Bitquery estimates $93.2 million in losses across six chains from CryptoBilis-linked wallet drains, with about $10 million frozen, while Ledger investigates and offers no repayment plan to affected buyers.", "detailed_summary_zh": "Bitquery estimates $93.2 million in losses across six chains from CryptoBilis-linked wallet drains, with about $10 million frozen, while Ledger's latest update offers affected buyers no repayment plan.", "detailed_summary_en": "Bitquery estimates $93.2 million in losses across six chains from CryptoBilis-linked wallet drains, with about $10 million frozen, while Ledger's latest update offers affected buyers no repayment plan.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.95, "story_ids": [ "rss:thedefiant.io_api_feed:9757529913080312" ], "sources": [ { "url": "https://thedefiant.io/news/hacks/bitquery-says-10-million-frozen-in-cryptobilis-linked-wallet-drains", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_0f8b8a56750e6053", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T12:55:40Z", "published_at": "2026-10-12T12:55:40Z", "first_seen_at": "2026-10-12T16:21:10.414753Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Ledger间谍软件恐慌蔓延至东南亚以外", "title_en": "Ledger spyware scare spreads beyond Southeast Asia", "what_changed_zh": "与 CryptoBilis 相关的 Ledger 钱包篡改事件已蔓延至东南亚以外，欧洲和南美也报告了带间谍软件的设备，包括来自德国 MediaMarkt 和菲律宾 LazMall 的官方经销商；Mark Karpelès 识别出可读取屏幕输出、绕过 Ledger Genuine Check 的间谍软件；Ledger 确认 10 月 9 日事件影响有限数量的 CryptoBilis 设备；CryptoBilis 前 CEO Arravind Prabu 表示公司已被收购、自己已卸任，前员工签署了保密条款。", "what_changed_en": "Ledger wallet tampering linked to CryptoBilis has spread beyond Southeast Asia, with spyware-fitted devices reported in Europe and South America, including from official resellers MediaMarkt (Germany) and LazMall (Philippines); Mark Karpelès identified spyware able to read screen output and bypass Ledger's Genuine Check; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices; former CryptoBilis CEO Arravind Prabu says the firm was acquired, he stepped down, and former staff signed a confidentiality clause.", "current_state_zh": "CryptoBilis 相关 Ledger 钱包盗取事件已涉及多地区，间谍软件篡改设备在亚洲、欧洲和南美被指认；Ledger 确认 10 月 9 日事件影响有限数量的 CryptoBilis 设备，损失超过 8600 万美元（Bitquery 此前估计 9320 万美元，约 1000 万美元被冻结），Ledger 仍在调查且未向受影响买家提供赔偿计划；CryptoBilis 前 CEO 称公司已被收购并已卸任。", "current_state_en": "The CryptoBilis-linked Ledger wallet drain incident now spans multiple regions, with spyware-tampered devices alleged in Asia, Europe, and South America; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices, losses exceed $86 million (Bitquery previously estimated $93.2 million with about $10 million frozen), Ledger continues to investigate and offers no repayment plan to affected buyers; former CryptoBilis CEO says the firm was acquired and he stepped down.", "detailed_summary_zh": "Tampered Ledger hardware wallets fitted with physical spyware have been identified across Asia, Europe, and South America after users who bought from reseller CryptoBilis lost over $86 million.", "detailed_summary_en": "Tampered Ledger hardware wallets fitted with physical spyware have been identified across Asia, Europe, and South America after users who bought from reseller CryptoBilis lost over $86 million.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.92, "story_ids": [ "rss:protos.com_feed_:1deabf18a8a1af56" ], "sources": [ { "url": "https://protos.com/ledger-spyware-scare-spreads-beyond-southeast-asia/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_e82b451b9de6b8e3", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T13:12:44Z", "published_at": "2026-10-12T13:12:44Z", "first_seen_at": "2026-10-12T16:21:01.980539Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Karpelès指出另一个Ledger植入物，公司维持对CryptoBilis的警告", "title_en": "Karpelès Flags Another Ledger Implant as Company Keeps CryptoBilis Warning", "what_changed_zh": "Ledger的安全文档承认，其Genuine Check验证无法检测出未触动安全芯片的间谍植入物，联合创始人Karpelès指出了另一个植入物，公司对CryptoBilis的警告仍然有效。", "what_changed_en": "Ledger's security documentation acknowledges that its Genuine Check verification cannot detect spying implants that leave the secure chip untouched, as co-founder Karpelès flags another implant and the company's CryptoBilis warning remains in force.", "current_state_zh": "Ledger的安全文档承认，其Genuine Check验证无法检测出未触动安全芯片的间谍植入物，联合创始人Karpelès指出了另一个植入物，公司对CryptoBilis的警告仍然有效。", "current_state_en": "Ledger's security documentation acknowledges that its Genuine Check verification cannot detect spying implants that leave the secure chip untouched, as co-founder Karpelès flags another implant and the company's CryptoBilis warning remains in force.", "detailed_summary_zh": "Ledger's security documentation acknowledges that its Genuine Check verification cannot detect spying implants that leave the secure chip untouched, as co-founder Karpelès flags another implant and the company's CryptoBilis warning remains in force.", "detailed_summary_en": "Ledger's security documentation acknowledges that its Genuine Check verification cannot detect spying implants that leave the secure chip untouched, as co-founder Karpelès flags another implant and the company's CryptoBilis warning remains in force.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:thedefiant.io_api_feed:2dddf462d8c09ef0" ], "sources": [ { "url": "https://thedefiant.io/news/security/karpel-s-flags-another-ledger-implant-as-company-keeps-cryptobilis-warning", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_aa526df46e8dce8a", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T13:45:06Z", "published_at": "2026-10-12T13:45:06Z", "first_seen_at": "2026-10-12T16:21:01.980506Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "OneKey切断与CryptoBilis的合作，提供免费钱包更换", "title_en": "OneKey Cuts Off CryptoBilis, Offers Free Wallet Replacements", "what_changed_zh": "OneKey的免费更换计划明确涵盖已使用设备，并将申请截止日期定为12月31日；通过CryptoBilis购买的OneKey设备更换资格范围为3月1日至10月12日。", "what_changed_en": "OneKey's free replacement program now explicitly includes used devices and sets a claim deadline of Dec. 31; the eligibility window for OneKey devices bought through CryptoBilis is March 1 to Oct. 12.", "current_state_zh": "Ledger硬件钱包供应链植入与盗取事件仍在调查中，OneKey已撤销CryptoBilis授权经销商资格并停止新增分销商，同时扩大免费更换计划：凡在3月1日至10月12日期间通过CryptoBilis购买的OneKey设备（包括已使用设备）均可申请免费更换，申请截止日期为12月31日。", "current_state_en": "The Ledger hardware-wallet supply-chain implant and theft incident remains under investigation; OneKey has revoked CryptoBilis's authorized-reseller status and halted new distributor appointments, and has expanded its free replacement program: any OneKey device bought through CryptoBilis between March 1 and Oct. 12, including used units, qualifies for free replacement, with claims due by Dec. 31.", "detailed_summary_zh": "OneKey has cut off reseller CryptoBilis and is offering free replacement wallets to anyone who bought a OneKey device from that reseller between March 1 and Oct. 12, including used units, with claims due by Dec. 31.", "detailed_summary_en": "OneKey has cut off reseller CryptoBilis and is offering free replacement wallets to anyone who bought a OneKey device from that reseller between March 1 and Oct. 12, including used units, with claims due by Dec. 31.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.95, "story_ids": [ "rss:thedefiant.io_api_feed:1d69927dd92bef3e" ], "sources": [ { "url": "https://thedefiant.io/news/security/onekey-cuts-off-cryptobilis-offers-free-wallet-replacements", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_d6ed24b36c814c5c", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T15:21:38Z", "published_at": "2026-10-12T15:21:38Z", "first_seen_at": "2026-10-12T16:21:01.980443Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "买家报告从MediaMarkt购买的第二台被篡改的Ledger，呼吁召回", "title_en": "Buyer Reports Second Tampered Ledger From MediaMarkt, Calls for Recall", "what_changed_zh": "一名买家报告从 MediaMarkt 发现第二台被篡改的 Ledger 设备，点名经销商 Aqipa，呼吁召回，并将设备送交 Ledger 分析。", "what_changed_en": "A buyer reports a second tampered Ledger device from MediaMarkt, names distributor Aqipa, calls for a recall, and sends the device to Ledger for analysis.", "current_state_zh": "CryptoBilis 相关 Ledger 钱包盗取事件已涉及多地区，间谍软件篡改设备在亚洲、欧洲和南美被指认；Ledger 确认 10 月 9 日事件影响有限数量的 CryptoBilis 设备，损失超过 8600 万美元（Bitquery 此前估计 9320 万美元，约 1000 万美元被冻结），Ledger 仍在调查且未向受影响买家提供赔偿计划；CryptoBilis 前 CEO 称公司已被收购并已卸任；一名买家报告从 MediaMarkt 发现第二台被篡改的 Ledger 设备，点名经销商 Aqipa，呼吁召回，并将设备送交 Ledger 分析。", "current_state_en": "The CryptoBilis-linked Ledger wallet drain incident now spans multiple regions, with spyware-tampered devices alleged in Asia, Europe, and South America; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices, losses exceed $86 million (Bitquery previously estimated $93.2 million with about $10 million frozen), Ledger continues to investigate and offers no repayment plan to affected buyers; former CryptoBilis CEO says the firm was acquired and he stepped down; a buyer reports a second tampered Ledger device from MediaMarkt, names distributor Aqipa, calls for a recall, and sends the device to Ledger for analysis.", "detailed_summary_zh": "A buyer reports finding a second tampered Ledger hardware wallet from MediaMarkt, names distributor Aqipa, and calls for a recall while the device is sent to Ledger for analysis.", "detailed_summary_en": "A buyer reports finding a second tampered Ledger hardware wallet from MediaMarkt, names distributor Aqipa, and calls for a recall while the device is sent to Ledger for analysis.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.9, "story_ids": [ "rss:thedefiant.io_api_feed:b987ab500ea8e638", "telegram:theblockbeats:200152", "telegram:theblockbeats:200153" ], "sources": [ { "url": "https://thedefiant.io/news/security/buyer-reports-second-tampered-ledger-from-mediamarkt-calls-for-recall", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://m.theblockbeats.info/downloads?type=new2", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://telegram.me/theblockbeats/200153", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_b97ca8d113c97f46", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-12T16:32:17Z", "published_at": "2026-10-12T16:32:17Z", "first_seen_at": "2026-10-12T20:21:35.778249Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger称疑似8700万美元盗币事件中所有已确认案例均与经销商CryptoBilis有关", "title_en": "Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis", "what_changed_zh": "Ledger 在 72 小时更新中表示，钱包盗取事件所有已确认案例均涉及经销商 CryptoBilis 售出的硬件钱包；CryptoBilis 已停止全部硬件钱包销售；Ledger 称自身系统和直销渠道未受影响，正与主管部门合作，并提醒授权经销商不得将退回产品重新上架。", "what_changed_en": "Ledger's 72-hour update says every confirmed case in the wallet-draining incident involves hardware wallets sold by reseller CryptoBilis; CryptoBilis has ceased all hardware wallet sales; Ledger says its own systems and direct channels are unaffected, is working with authorities, and reminds authorized resellers never to restock returned products.", "current_state_zh": "CryptoBilis 相关 Ledger 钱包盗取事件已涉及多地区，间谍软件篡改设备在亚洲、欧洲和南美被指认；Ledger 确认 10 月 9 日事件影响有限数量的 CryptoBilis 设备，损失超过 8600 万美元（Bitquery 此前估计 9320 万美元，约 1000 万美元被冻结），Ledger 仍在调查且未向受影响买家提供赔偿计划；CryptoBilis 前 CEO 称公司已被收购并已卸任，CryptoBilis 已停止全部硬件钱包销售；Ledger 在 72 小时更新中称所有已确认案例均涉 CryptoBilis 设备，自身系统与直销渠道未受影响，正与主管部门合作并警告经销商不得重新上架退回产品；一名买家报告从 MediaMarkt 发现第二台被篡改的 Ledger 设备，点名经销商 Aqipa，呼吁召回，并将设备送交 Ledger 分析。", "current_state_en": "The CryptoBilis-linked Ledger wallet drain incident now spans multiple regions, with spyware-tampered devices alleged in Asia, Europe, and South America; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices, losses exceed $86 million (Bitquery previously estimated $93.2 million with about $10 million frozen), Ledger continues to investigate and offers no repayment plan to affected buyers; former CryptoBilis CEO says the firm was acquired and he stepped down, and CryptoBilis has ceased all hardware wallet sales; in a 72-hour update, Ledger said all confirmed cases involve CryptoBilis devices, its own systems and direct channels are unaffected, it is working with authorities, and it warned resellers not to restock returned products; a buyer reports a second tampered Ledger device from MediaMarkt, names distributor Aqipa, calls for a recall, and sends the device to Ledger for analysis.", "detailed_summary_zh": "Ledger's 72-hour update states that every confirmed case in the suspected $87M wallet-draining incident traces back to hardware wallets sold by reseller CryptoBilis, which has now stopped all hardware wallet sales, while Ledger says its own systems and direct channels are unaffected.", "detailed_summary_en": "Ledger's 72-hour update states that every confirmed case in the suspected $87M wallet-draining incident traces back to hardware wallets sold by reseller CryptoBilis, which has now stopped all hardware wallet sales, while Ledger says its own systems and direct channels are unaffected.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.95, "story_ids": [ "rss:decrypt.co_feed:5bae45306fd7b451" ], "sources": [ { "url": "https://decrypt.co/380706/ledger-says-all-confirmed-cases-in-suspected-87m-drain-tied-to-reseller-cryptobilis", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_5a4d772ef0b00bc1", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T06:51:02Z", "published_at": "2026-10-13T06:51:02Z", "first_seen_at": "2026-10-13T10:23:17.240418Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger确认经销商CryptoBilis设备遭硬件植入，助记词被LTE外传", "title_en": "Ledger确认经销商CryptoBilis设备遭硬件植入，助记词被LTE外传", "what_changed_zh": "Ledger 安全团队发布硬件植入事件最新调查进展，确认 CryptoBilis 销售的部分 Ledger 设备外壳内被植入未授权硬件，可在初始化时读取屏幕并截取 24 个助记词，再通过内置微控制器与 eSIM 经 LTE 外传；该组件不修改 Secure Element 或 Ledger OS，也不干预交易签名。Ledger 同时表示尚未确认受影响用户总数及损失金额，网上流传数字未经官方核实。", "what_changed_en": "Ledger's security team released the latest investigation update on the hardware implant incident, confirming that some Ledger devices sold by CryptoBilis contained unauthorized hardware implanted inside the casing that can read the screen and capture the 24-word seed phrase during initialization, then exfiltrate it over LTE via an embedded microcontroller and eSIM; the component does not modify the Secure Element or Ledger OS and does not interfere with transaction signing. Ledger also said it has not confirmed the total number of affected users or loss amount, and circulating online figures are unverified.", "current_state_zh": "Ledger 确认 CryptoBilis 渠道设备存在硬件植入，植入物通过读取屏幕截取 24 个助记词并经 LTE/eSIM 外传，且不触碰 Secure Element 或交易签名；10 月 9 日事件所有已确认损失均与 CryptoBilis 渠道设备有关，其他渠道暂未核实；CryptoBilis 已暂停销售 Ledger 产品；Ledger 称受影响用户总数及损失金额尚未确认，网上数字未经官方核实，建议未初始化设备不要设置、已设置用户转移资产并生成新助记词，调查仍在继续。", "current_state_en": "Ledger has confirmed hardware implants in CryptoBilis-channel devices; the implant reads the screen to capture the 24-word seed phrase during initialization and exfiltrates it over LTE/eSIM without touching the Secure Element or transaction signing; all confirmed losses from the October 9 incident are linked to CryptoBilis-channel devices, while other channels remain unverified; CryptoBilis has suspended sales of Ledger products; Ledger says the total affected-user count and loss amount are not yet confirmed, online figures are unverified, and it advises users not to initialize uninitialized devices and for already-configured users to move assets and generate new seed phrases; the investigation continues.", "detailed_summary_zh": "Ledger confirmed that some hardware wallets sold by reseller CryptoBilis contained unauthorized implants that read the screen to capture 24-word seed phrases during initialization and exfiltrate them over LTE via an embedded eSIM, with all confirmed losses from the October 9 theft linked to that sales channel.", "detailed_summary_en": "Ledger confirmed that some hardware wallets sold by reseller CryptoBilis contained unauthorized implants that read the screen to capture 24-word seed phrases during initialization and exfiltrate them over LTE via an embedded eSIM, with all confirmed losses from the October 9 theft linked to that sales channel.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.93, "story_ids": [ "telegram:theblockbeats:200202", "telegram:foresightnews:120273" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371535?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/115068", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_f878461c29d4ee64", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T08:45:10Z", "published_at": "2026-10-13T08:45:10Z", "first_seen_at": "2026-10-13T10:23:41.082489Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger详述CryptoBilis所售钱包中支持LTE的间谍植入物", "title_en": "Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis", "what_changed_zh": "Ledger详细说明了经销商CryptoBilis所售Ledger硬件钱包中被植入的、支持LTE的恶意植入物如何通过eSIM捕获用户的24词助记词并通过蜂窝网络传输，促使CryptoBilis停止销售，Trezor和OneKey也与该经销商断绝关系。", "what_changed_en": "Ledger detailed how malicious LTE-enabled implants embedded in Ledger hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases via an eSIM and transmitted them over cellular networks, prompting CryptoBilis to halt sales and Trezor and OneKey to cut ties with the reseller.", "current_state_zh": "Ledger详细说明了经销商CryptoBilis所售Ledger硬件钱包中被植入的、支持LTE的恶意植入物如何通过eSIM捕获用户的24词助记词并通过蜂窝网络传输，促使CryptoBilis停止销售，Trezor和OneKey也与该经销商断绝关系。", "current_state_en": "Ledger detailed how malicious LTE-enabled implants embedded in Ledger hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases via an eSIM and transmitted them over cellular networks, prompting CryptoBilis to halt sales and Trezor and OneKey to cut ties with the reseller.", "detailed_summary_zh": "Ledger detailed how malicious LTE-enabled implants embedded in Ledger hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases via an eSIM and transmitted them over cellular networks, prompting CryptoBilis to halt sales and Trezor and OneKey to cut ties with the reseller.", "detailed_summary_en": "Ledger detailed how malicious LTE-enabled implants embedded in Ledger hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases via an eSIM and transmitted them over cellular networks, prompting CryptoBilis to halt sales and Trezor and OneKey to cut ties with the reseller.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:cointelegraph.com_rss:29737ebe1c663511", "rss:www.coindesk.com_arc_outboundfeeds_rss_:2ec948d13bc81c58" ], "sources": [ { "url": "https://cointelegraph.com/news/ledger-cellular-implants-wallets-sold-cryptobilis?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/tech/2026/10/13/ledger-says-spy-chip-inside-cryptobilis-ledger-devices-transmitted-wallet-keys-over-mobile-network", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_0e712766d27beecc", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T09:20:02Z", "published_at": "2026-10-13T09:20:02Z", "first_seen_at": "2026-10-13T10:23:17.257983Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "新加坡机场所购Ledger Flex被确认植入间谍模块，硬件钱包供应链风险扩大", "title_en": "新加坡机场所购Ledger Flex被确认植入间谍模块，硬件钱包供应链风险扩大", "what_changed_zh": "Mark Karpelès通过拆解图片和视频确认，在新加坡机场Metapod购买的一台Ledger Flex内含植入的电路板和线路，可窃取用户的助记词，这是硬件钱包供应链遭入侵范围扩大的最新证据。", "what_changed_en": "Mark Karpelès confirmed via teardown images and video that a Ledger Flex purchased at Singapore airport's Metapod contained an implanted board and wiring that could steal the user's seed phrase, the latest evidence of an expanding hardware-wallet supply-chain compromise.", "current_state_zh": "Mark Karpelès通过拆解图片和视频确认，在新加坡机场Metapod购买的一台Ledger Flex内含植入的电路板和线路，可窃取用户的助记词，这是硬件钱包供应链遭入侵范围扩大的最新证据。", "current_state_en": "Mark Karpelès confirmed via teardown images and video that a Ledger Flex purchased at Singapore airport's Metapod contained an implanted board and wiring that could steal the user's seed phrase, the latest evidence of an expanding hardware-wallet supply-chain compromise.", "detailed_summary_zh": "Mark Karpelès confirmed via teardown images and video that a Ledger Flex purchased at Singapore airport's Metapod contained an implanted board and wiring that could steal the user's seed phrase, the latest evidence of an expanding hardware-wallet supply-chain compromise.", "detailed_summary_en": "Mark Karpelès confirmed via teardown images and video that a Ledger Flex purchased at Singapore airport's Metapod contained an implanted board and wiring that could steal the user's seed phrase, the latest evidence of an expanding hardware-wallet supply-chain compromise.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:theblockbeats:200236" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371567?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_7ad83bbde9655f9a", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T10:09:01Z", "published_at": "2026-10-13T10:09:01Z", "first_seen_at": "2026-10-13T10:23:40.840763Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "MediaMarktSaturn在篡改报告后下架Ledger产品", "title_en": "MediaMarktSaturn pulls Ledger products amid tampering reports", "what_changed_zh": "MediaMarktSaturn 已将所有 Ledger 产品从门店和线上平台下架，并与制造商联系；此前一名买家报告在两家 MediaMarkt 门店购买的两台 Ledger 钱包内含未授权线缆和蜂窝模块，使调查范围扩大至 CryptoBilis 以外。", "what_changed_en": "MediaMarktSaturn has removed all Ledger products from its stores and online platforms and is in contact with the manufacturer; this follows a buyer reporting two Ledger wallets purchased from separate MediaMarkt stores containing unauthorized cables and cellular modules, widening the investigation beyond CryptoBilis.", "current_state_zh": "Ledger 确认 CryptoBilis 渠道设备存在硬件植入，植入物通过读取屏幕截取 24 个助记词并经 LTE/eSIM 外传，且不触碰 Secure Element 或交易签名；所有已确认损失均与 CryptoBilis 渠道设备有关，其他渠道正在核实；CryptoBilis 已暂停销售 Ledger 产品；MediaMarktSaturn 已下架所有 Ledger 产品并与制造商联系；Ledger 称受影响用户总数及损失金额尚未确认，网上数字未经官方核实，建议未初始化设备不要设置、已设置用户转移资产并生成新助记词，调查仍在继续。", "current_state_en": "Ledger has confirmed hardware implants in CryptoBilis-channel devices; the implant reads the screen to capture the 24-word seed phrase during initialization and exfiltrates it over LTE/eSIM without touching the Secure Element or transaction signing; all confirmed losses are linked to CryptoBilis-channel devices, while other channels are being investigated; CryptoBilis has suspended sales of Ledger products; MediaMarktSaturn has removed all Ledger products from its stores and online platforms and is in contact with the manufacturer; Ledger says the total affected-user count and loss amount are not yet confirmed, online figures are unverified, and it advises users not to initialize uninitialized devices and for already-configured users to move assets and generate new seed phrases; the investigation continues.", "detailed_summary_zh": "MediaMarktSaturn has removed all Ledger hardware wallets from its stores and online platforms after a buyer reported tampered devices containing unauthorized cables and cellular modules, widening Ledger's investigation beyond Southeast Asian reseller CryptoBilis.", "detailed_summary_en": "MediaMarktSaturn has removed all Ledger hardware wallets from its stores and online platforms after a buyer reported tampered devices containing unauthorized cables and cellular modules, widening Ledger's investigation beyond Southeast Asian reseller CryptoBilis.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.93, "story_ids": [ "rss:cointelegraph.com_rss:e9d8561a2b280af5", "telegram:foresightnews:120298", "telegram:theblockbeats:200246" ], "sources": [ { "url": "https://cointelegraph.com/news/mediamarkt-pulls-ledger-wallet-security-incident?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/115089", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://m.theblockbeats.info/flash/371576?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_04644a024ed3367a", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T11:38:02Z", "published_at": "2026-10-13T11:38:02Z", "first_seen_at": "2026-10-13T12:08:57.536538Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger审查设备销售政策和流程，评估设备防篡改保护措施", "title_en": "Ledger审查设备销售政策和流程，评估设备防篡改保护措施", "what_changed_zh": "Ledger首席技术官Charles Guillemet表示，公司正在审查面向消费者的设备销售政策和流程，并评估设备的防篡改保护措施；同时提醒用户不要自行拆开可疑硬件钱包，而应寄送Ledger检查。报道还提及此次植入间谍软件事件造成约9000万美元加密货币被盗。", "what_changed_en": "Ledger CTO Charles Guillemet said the company is reviewing its consumer device sales policies and processes and assessing device tamper-resistance protections; it also urged users not to open suspicious hardware wallets themselves but to send them to Ledger for inspection. The report also mentioned an estimated $90 million in crypto stolen in the spyware-planting incident.", "current_state_zh": "Ledger正在审查其消费者设备销售政策与流程并评估防篡改保护措施，CTO建议用户不要自行拆开可疑钱包；调查已扩展至MediaMarktSaturn等渠道，CryptoBilis停止销售，Trezor和OneKey断绝关系，估计损失约9000万美元。", "current_state_en": "Ledger is reviewing its consumer device sales policies and processes and assessing tamper-resistance protections, with its CTO advising users not to open suspicious wallets; the investigation has widened to channels such as MediaMarktSaturn, CryptoBilis halted sales, Trezor and OneKey cut ties, and estimated losses are around $90 million.", "detailed_summary_zh": "Ledger is reviewing its consumer device sales policies and assessment of tamper-resistance protections, and urging users not to open suspicious hardware wallets, after spyware-planted devices led to an estimated $90M in stolen crypto.", "detailed_summary_en": "Ledger is reviewing its consumer device sales policies and assessment of tamper-resistance protections, and urging users not to open suspicious hardware wallets, after spyware-planted devices led to an estimated $90M in stolen crypto.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.95, "story_ids": [ "telegram:theblockbeats:200257" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371590?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_8b159f967322dcb9", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T11:53:15Z", "published_at": "2026-10-13T11:53:15Z", "first_seen_at": "2026-10-13T12:13:24.371450Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger发现LTE植入物在疑似8600万美元盗取事件中窃取恢复短语", "title_en": "Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain", "what_changed_zh": "Ledger的Donjon安全团队确认，东南亚经销商CryptoBilis销售的钱包中存在未经授权的硬件植入物，该植入物会在设置过程中从设备屏幕读取24词恢复短语，并通过预置eSIM经LTE传输，所有已确认的损失均与通过该经销商购买的设备有关，疑似被盗资金达8600万美元。", "what_changed_en": "Ledger's Donjon security team confirmed an unauthorized hardware implant in wallets sold by Southeast Asian reseller CryptoBilis that reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE via a provisioned eSIM, with all confirmed losses from the suspected $86M drain tied to devices bought through that reseller.", "current_state_zh": "Ledger的Donjon安全团队确认，东南亚经销商CryptoBilis销售的钱包中存在未经授权的硬件植入物，该植入物会在设置过程中从设备屏幕读取24词恢复短语，并通过预置eSIM经LTE传输，所有已确认的损失均与通过该经销商购买的设备有关，疑似被盗资金达8600万美元。", "current_state_en": "Ledger's Donjon security team confirmed an unauthorized hardware implant in wallets sold by Southeast Asian reseller CryptoBilis that reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE via a provisioned eSIM, with all confirmed losses from the suspected $86M drain tied to devices bought through that reseller.", "detailed_summary_zh": "Ledger's Donjon security team confirmed an unauthorized hardware implant in wallets sold by Southeast Asian reseller CryptoBilis that reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE via a provisioned eSIM, with all confirmed losses from the suspected $86M drain tied to devices bought through that reseller.", "detailed_summary_en": "Ledger's Donjon security team confirmed an unauthorized hardware implant in wallets sold by Southeast Asian reseller CryptoBilis that reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE via a provisioned eSIM, with all confirmed losses from the suspected $86M drain tied to devices bought through that reseller.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:decrypt.co_feed:a6f8e29de19765d8" ], "sources": [ { "url": "https://decrypt.co/380826/ledger-finds-lte-implant-that-stole-recovery-phrases-in-suspected-86m-drain", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_af34e3d874d3000c", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T12:43:02Z", "published_at": "2026-10-13T12:43:02Z", "first_seen_at": "2026-10-13T14:18:11.619089Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger：MediaMarkt暂停销售源于德国用户报告发现植入物，暂无资金损失", "title_en": "Ledger：MediaMarkt暂停销售源于德国用户报告发现植入物，暂无资金损失", "what_changed_zh": "新增：Ledger官方确认已与MediaMarkt Saturn协调暂停德国线上及线下门店销售，以配合一名德国用户疑似植入物报告的调查；Ledger表示该报告相关事件暂无资金损失，且无迹象表明其基础设施、系统或服务遭到入侵，客服正在审查报告，Donjon将检查设备。", "what_changed_en": "New: Ledger officially confirmed it coordinated with MediaMarkt Saturn to suspend online and in-store sales in Germany pending investigation into a German user's suspected implant report; Ledger said there were no reported fund losses tied to that report and no signs of compromise to its infrastructure, systems, or services, with customer support reviewing the report and Donjon set to inspect devices.", "current_state_zh": "事件仍处于监控中；Ledger已与德国零售商MediaMarkt Saturn协调暂停其线上及线下门店销售，以调查一名德国用户报告的疑似植入物；Ledger称该报告相关事件暂无资金损失，亦无迹象表明其基础设施、系统或服务遭入侵，客服与Donjon团队正在审查报告并检查设备。此前已确认的CryptoBilis经销商设备植入物及疑似8600万美元损失仍属于同一供应链安全事件。", "current_state_en": "The incident remains under monitoring; Ledger has coordinated with German retailer MediaMarkt Saturn to suspend online and in-store sales while investigating a German user's suspected implant report. Ledger said there were no reported fund losses tied to that report and no signs of compromise to its infrastructure, systems, or services, with customer support and Donjon reviewing the report and inspecting devices. The previously confirmed CryptoBilis reseller device implants and suspected $86M drain remain part of the same supply-chain security incident.", "detailed_summary_zh": "Ledger confirmed that MediaMarkt Saturn has suspended sales of its hardware wallets in Germany pending investigation into a user report of a suspected implanted device, with no funds lost and no sign of infrastructure compromise.", "detailed_summary_en": "Ledger confirmed that MediaMarkt Saturn has suspended sales of its hardware wallets in Germany pending investigation into a user report of a suspected implanted device, with no funds lost and no sign of infrastructure compromise.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.92, "story_ids": [ "telegram:theblockbeats:200270" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/371604?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_297849731069bd61", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T13:35:09Z", "published_at": "2026-10-13T13:35:09Z", "first_seen_at": "2026-10-13T14:18:27.572470Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "德国Ledger经销商在8600万美元盗取事件后暂停销售", "title_en": "German Ledger reseller pauses sales following $86M draining incident", "what_changed_zh": "新报道称，Mark Karpelès 已在菲律宾官方经销商 LazMall 销售的 Ledger 钱包中也发现间谍软件，使受影响经销商范围进一步扩大；Ledger 最新声明称尚未核实来自其他渠道购买签名器的资金流出，并正在审查其他签名器和地点的植入物报告，同时 CryptoBilis 在调查期间继续停售。", "what_changed_en": "The new report says Mark Karpelès has also found spyware in Ledger wallets sold by official Philippine reseller LazMall, further widening the affected-reseller scope; Ledger’s latest statement says it has not verified a drain linked to a signer bought elsewhere and is reviewing reports of implants in other signers and locations, while CryptoBilis remains not selling wallets during the investigation.", "current_state_zh": "事件仍处于监控中；已确认的植入物和疑似8600万美元资金流出仍与CryptoBilis销售的设备相关，CryptoBilis在调查期间停售；MediaMarkt Saturn已暂停德国线上及线下门店的Ledger销售；Karpelès的拆解分析还指向MediaMarkt、新加坡Metapod及菲律宾官方经销商LazMall销售的钱包；Ledger表示尚未核实其他渠道购买设备相关的资金流出，并正在审查其他经销商和地点的植入物报告。", "current_state_en": "The incident remains under monitoring; the confirmed implant and suspected $86M drain remain tied to devices sold by CryptoBilis, which is not selling wallets during the investigation; MediaMarkt Saturn has suspended online and in-store Ledger sales in Germany; Karpelès’s teardowns also point to wallets sold by MediaMarkt, Singapore’s Metapod, and official Philippine reseller LazMall; Ledger says it has not verified a drain linked to devices bought elsewhere and is reviewing implant reports from other resellers and locations.", "detailed_summary_zh": "German official Ledger reseller MediaMarkt has removed all Ledger products from stores and online platforms after spyware was found in wallets it sold, part of a supply-chain attack linked to an $86 million draining incident that has now surfaced across multiple official resellers.", "detailed_summary_en": "German official Ledger reseller MediaMarkt has removed all Ledger products from stores and online platforms after spyware was found in wallets it sold, part of a supply-chain attack linked to an $86 million draining incident that has now surfaced across multiple official resellers.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.9, "story_ids": [ "rss:protos.com_feed_:f64c1a7a7c6f5527" ], "sources": [ { "url": "https://protos.com/german-ledger-reseller-pauses-sales-following-86m-draining-incident/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_d0960af8b61516b8", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T16:14:50Z", "published_at": "2026-10-13T16:14:50Z", "first_seen_at": "2026-10-13T18:22:02.941035Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Ledger发现加密钱包被植入间谍程序后，Trezor削减经销商", "title_en": "Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets", "what_changed_zh": "在Ledger的Donjon团队确认，通过经销商CryptoBilis售出的硬件钱包中被植入间谍程序，可捕获助记词并通过LTE外传——链上追踪到疑似被盗资金达8600万美元——之后，Trezor出于预防考虑，决定在2027年1月1日前削减其自有授权经销商网络。", "what_changed_en": "After Ledger's Donjon team confirmed a spy implant in hardware wallets sold via reseller CryptoBilis that captures seed phrases and exfiltrates them over LTE — with $86M in suspected thefts traced onchain — Trezor moved to cut its own authorized reseller network by January 1, 2027 as a precaution.", "current_state_zh": "在Ledger的Donjon团队确认，通过经销商CryptoBilis售出的硬件钱包中被植入间谍程序，可捕获助记词并通过LTE外传——链上追踪到疑似被盗资金达8600万美元——之后，Trezor出于预防考虑，决定在2027年1月1日前削减其自有授权经销商网络。", "current_state_en": "After Ledger's Donjon team confirmed a spy implant in hardware wallets sold via reseller CryptoBilis that captures seed phrases and exfiltrates them over LTE — with $86M in suspected thefts traced onchain — Trezor moved to cut its own authorized reseller network by January 1, 2027 as a precaution.", "detailed_summary_zh": "After Ledger's Donjon team confirmed a spy implant in hardware wallets sold via reseller CryptoBilis that captures seed phrases and exfiltrates them over LTE — with $86M in suspected thefts traced onchain — Trezor moved to cut its own authorized reseller network by January 1, 2027 as a precaution.", "detailed_summary_en": "After Ledger's Donjon team confirmed a spy implant in hardware wallets sold via reseller CryptoBilis that captures seed phrases and exfiltrates them over LTE — with $86M in suspected thefts traced onchain — Trezor moved to cut its own authorized reseller network by January 1, 2027 as a precaution.", "background_zh": "CryptoBilis被列为Ledger在印度尼西亚、马来西亚和菲律宾的官方经销商，Ledger已要求该公司在调查期间暂停所有销售和发货。2022年5月，Trezor曾警告称，有未授权卖家在俄罗斯市场上销售假冒的Model T钱包，这些设备被拆开、重新封装并更换了内部元件，其生成的助记词可被预测或预先设定；当时Trezor的建议是只从官方商店或授权经销商购买。Trezor本周早些时候还表示，CryptoBilis此前已被移出其卖家名单，且未收到来自该零售商处被篡改Trezor设备的报告。", "background_en": "CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines, and Ledger asked the company to pause all sales and shipments during the investigation. In May 2022, Trezor warned that counterfeit Model T wallets were being sold on a Russian marketplace by a non-authorized seller, with opened, resealed devices whose recovery phrases were predictable or predefined; its advice then was to buy only from its official shop or an authorized reseller. Trezor also said earlier this week that CryptoBilis was already off its seller list and that it had received no reports of tampered Trezor devices from that retailer.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件主要通过硬件钱包分销渠道与自托管信任传导：通过第三方经销商购买设备的用户面临更高的交易对手风险，受影响的环节是钱包厂商的经销商审核、设备采购来源与售后验证，而非某一特定代币。Ledger暂停CryptoBilis销售、Trezor收缩经销商渠道，都会把销售转向厂商直销。", "market_impact_en": "The incident transmits mainly through hardware-wallet distribution and self-custody trust: buyers of devices through third-party resellers face elevated counterparty risk, and wallet makers' reseller vetting, device sourcing and after-sale verification become the exposed segment rather than any specific token. Ledger's paused CryptoBilis sales and Trezor's shrinking reseller channel both shift volume toward direct-from-vendor purchases.", "importance_score": 8.5, "references": [ { "url": "https://coin360.com/news/ledger-cryptobilis-wallet-drains", "title": "Ledger Probes CryptoBilis Drains as Losses Top $86M" }, { "url": "https://dev.to/anoymask/ledger-nano-x-supply-chain-attack-lteesim-hardware-implant-steals-seed-phrases-19e3", "title": "Ledger Nano X Supply Chain Attack: LTE/eSIM Hardware Implant ..." }, { "url": "https://www.tokenpost.com/news/technology/29597", "title": "Ledger Investigates $93.2 Million Crypto Drain Tied to Reseller Devices" } ], "confidence": 0.75, "story_ids": [ "rss:decrypt.co_feed:f6300edabf1b69b6" ], "sources": [ { "url": "https://decrypt.co/380848/trezor-cuts-resellers-ledger-finds-spy-implant-crypto-wallets", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c5b84f55408e1672", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-13T23:28:19Z", "published_at": "2026-10-13T23:28:19Z", "first_seen_at": "2026-10-13T23:49:14.055968Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Ledger 要求经销商暂停在东南亚和香港的销售", "title_en": "Ledger asks resellers to halt sales in Southeast Asia and Hong Kong", "what_changed_zh": "Ledger要求印度尼西亚、新加坡、泰国、菲律宾、越南、马来西亚及香港的经销商暂停销售并下架硬件钱包，以调查设备篡改事件；此前仅要求经销商CryptoBilis停售和停止发货。", "what_changed_en": "Ledger requested resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove its hardware wallets from shelves while it investigates device tampering; this expands on the earlier request for reseller CryptoBilis to halt sales and shipments.", "current_state_zh": "Ledger已将销售暂停请求扩大至六个东南亚国家和香港的经销商，设备下架，调查仍在进行；Ledger称已确认事件仍限于东南亚，且未核实其他地区购买设备相关的资金流出。", "current_state_en": "Ledger has expanded its sales suspension request to resellers in six Southeast Asian countries and Hong Kong, with devices removed from shelves and the investigation ongoing; Ledger says confirmed incidents remain contained to Southeast Asia and it has not verified a drain linked to a device bought elsewhere.", "detailed_summary_zh": "Ledger asked resellers and distributors across six Southeast Asian countries plus Hong Kong to suspend sales and remove its hardware wallets from shelves while it investigates confirmed device-tampering incidents in the region.", "detailed_summary_en": "Ledger asked resellers and distributors across six Southeast Asian countries plus Hong Kong to suspend sales and remove its hardware wallets from shelves while it investigates confirmed device-tampering incidents in the region.", "background_zh": "相关调查于 10 月 9 日公开，此前有用户报告称，通过区域经销商 CryptoBilis 购买的 Ledger 设备涉及加密资产被盗；Ledger 表示所有已确认的损失都涉及通过该经销商售出的设备。Ledger 称目前确认的相关事件仍局限于东南亚，尚未核实其他地区购买的设备与资金被盗有关。该公司还强调，没有迹象表明其自身基础设施、系统、服务或官方直销渠道遭到入侵。研究人员称，自 9 月 16 日起已发现 Ledger X 设备中被植入该装置，被篡改的设备以近原价一半的价格出售。", "background_en": "The investigation was disclosed on Oct 9 after users reported crypto asset thefts linked to Ledger devices bought through CryptoBilis, a reseller in the region; Ledger has said all confirmed losses involve devices sold through that reseller. Ledger said the only confirmed incidents remain contained in Southeast Asia and that it has not verified a drain linked to a device bought elsewhere. It added that it has no indication its own infrastructure, systems, services or direct sales channel have been compromised. Researchers have reported the implant in Ledger X devices since Sept 16, with tampered units offered at nearly half the original price.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "此次影响集中在 Ledger 设备在东南亚及香港的线下零售与经销渠道，传导路径主要作用于供应链完整性和自托管信心，而非协议流动性。Ledger 称其官方直销渠道未受影响；与此同时，竞争对手 Trezor 表示出于预防将于 2027 年 1 月 1 日终止对经销商的授权，这可能使硬件钱包需求在不同厂商和销售渠道之间发生转移。", "market_impact_en": "The disruption sits in the physical retail and reseller channel for Ledger devices in Southeast Asia and Hong Kong, so the transmission runs through supply-chain integrity and self-custody sentiment rather than protocol liquidity. Ledger says its direct sales channel is unaffected, while rival Trezor's stated plan to end reseller authorizations from Jan 1, 2027 as a precautionary measure could shift hardware-wallet demand between vendors and sales channels.", "importance_score": 8.5, "references": [ { "url": "https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen", "title": "Ledger investigates potential wallet tampering after reports of $86..." }, { "url": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "title": "Ledger confirms spy chip implant behind wallet crypto thefts" } ], "confidence": 0.96, "story_ids": [ "rss:cointelegraph.com_rss:6961b8494eef32aa", "telegram:theblockbeats:200314", "telegram:foresightnews:120335", "rss:protos.com_feed_:dd5b2a49a6d2c731", "rss:decrypt.co_feed:407305b28221063a" ], "sources": [ { "url": "https://cointelegraph.com/news/ledger-asks-resellers-to-halt-sales-in-southeast-asia-and-hong-kong?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://m.theblockbeats.info/flash/371648?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/115124", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://protos.com/ledger-asks-more-southeast-asia-resellers-to-halt-wallet-sales/", "label": "Protos", "source_type": "rss", "official": false }, { "url": "https://decrypt.co/380940/ledger-asks-resellers-in-seven-asian-markets-to-pull-devices-after-suspected-86m-drain", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_41e5ebc754e5656f", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-15T11:57:03Z", "published_at": "2026-10-15T11:57:03Z", "first_seen_at": "2026-10-15T15:21:32.091221Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Ledger回应硬件植入攻击：属局部分销渠道攻击，要求东南亚及香港授权渠道暂停销售", "title_en": "Ledger回应硬件植入攻击：属局部分销渠道攻击，要求东南亚及香港授权渠道暂停销售", "what_changed_zh": "Ledger首次将事件正式定性为设备离开公司控制后的局部分销渠道攻击，而非系统性供应链攻击，并称芯片、操作系统及服务器未被攻破；同时收紧渠道规则：退货设备即便看似全新、未开封也不得再次出售，产品不得置于货架或展示区，须在后场存放并在购买时交付，渠道须及时上报异常产品；Ledger还表示已赴德国等地门店购买并拆检设备、检查仓库及自有库存样本，均未发现篡改，并正与执法机构追踪资金。", "what_changed_en": "Ledger formally characterized the incident as a localized distribution-channel attack after devices left its control, rather than a systemic supply-chain compromise, saying its chips, OS, and servers were not breached; it also tightened channel rules — returned devices cannot be resold even if seemingly new or unopened, products must not be displayed on shelves and must be stored in backrooms and delivered at purchase, and channels must promptly report anomalous products; Ledger added it bought and inspected devices at stores in Germany and elsewhere and checked warehouses and its own inventory samples without finding tampering, while working with law enforcement to trace funds.", "current_state_zh": "Ledger将事件定性为设备离开控制后的局部分销渠道攻击，要求东南亚及香港授权经销商暂停销售并执行更严格的退货、存放与上报规则；已检查德国等地门店及仓库样本未发现篡改，芯片/操作系统/服务器未受损，调查与执法追踪持续。", "current_state_en": "Ledger has characterized the incident as a localized distribution-channel attack after devices left its control, requiring authorized resellers in Southeast Asia and Hong Kong to suspend sales and follow stricter return, storage, and reporting rules; inspections of devices from stores in Germany and elsewhere and warehouse samples found no tampering, with its chips/OS/servers uncompromised and investigation and law-enforcement tracing ongoing.", "detailed_summary_zh": "Ledger confirmed a localized distribution-channel attack in which criminals implanted hidden seed-phrase-stealing components into genuine devices resold through Southeast Asian distributors, and ordered authorized resellers in Southeast Asia and Hong Kong to suspend sales while tightening return, storage, and reporting rules.", "detailed_summary_en": "Ledger confirmed a localized distribution-channel attack in which criminals implanted hidden seed-phrase-stealing components into genuine devices resold through Southeast Asian distributors, and ordered authorized resellers in Southeast Asia and Hong Kong to suspend sales while tightening return, storage, and reporting rules.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.95, "story_ids": [ "telegram:theblockbeats:200719", "telegram:foresightnews:120514" ], "sources": [ { "url": "https://m.theblockbeats.info/flash/372056?from=telegram", "label": "theblockbeats", "source_type": "telegram", "official": false }, { "url": "https://foresightnews.pro/news/h5Detail/115280", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_e995462022770a6d", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-15T12:42:42Z", "published_at": "2026-10-15T12:42:42Z", "first_seen_at": "2026-10-15T15:21:29.011175Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Ledger：有组织团伙数月渗透供应链植入恶意", "title_en": "Ledger: Organized Syndicate Infiltrated Supply Chain for Months to Implant Malic", "what_changed_zh": "Ledger披露，一个有组织团伙花费数月时间将恶意硬件植入正版Ledger设备，并通过东南亚转售渠道重新分销，以拦截助记词并盗取用户资产；同时确认其安全芯片、BOLOS操作系统和服务器基础设施未遭入侵。", "what_changed_en": "Ledger disclosed that an organized syndicate spent months implanting malicious hardware into genuine Ledger devices and redistributing them through Southeast Asian resale channels to intercept seed phrases and drain user assets, while confirming its secure element chips, BOLOS OS, and server infrastructure were not compromised.", "current_state_zh": "Ledger披露，一个有组织团伙花费数月时间将恶意硬件植入正版Ledger设备，并通过东南亚转售渠道重新分销，以拦截助记词并盗取用户资产；同时确认其安全芯片、BOLOS操作系统和服务器基础设施未遭入侵。", "current_state_en": "Ledger disclosed that an organized syndicate spent months implanting malicious hardware into genuine Ledger devices and redistributing them through Southeast Asian resale channels to intercept seed phrases and drain user assets, while confirming its secure element chips, BOLOS OS, and server infrastructure were not compromised.", "detailed_summary_zh": "Ledger disclosed that an organized syndicate spent months implanting malicious hardware into genuine Ledger devices and redistributing them through Southeast Asian resale channels to intercept seed phrases and drain user assets, while confirming its secure element chips, BOLOS OS, and server infrastructure were not compromised.", "detailed_summary_en": "Ledger disclosed that an organized syndicate spent months implanting malicious hardware into genuine Ledger devices and redistributing them through Southeast Asian resale channels to intercept seed phrases and drain user assets, while confirming its secure element chips, BOLOS OS, and server infrastructure were not compromised.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:wublockchainenglish:26423" ], "sources": [ { "url": "https://wublockchain.xyz/news/news-21250", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_73b407a77da42cdf", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-15T22:42:58Z", "published_at": "2026-10-15T22:42:58Z", "first_seen_at": "2026-10-15T23:11:26.387997Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "骗子因被篡改的Ledger损失480万美元：Asia Express", "title_en": "Scammer loses $4.8M stored on tampered Ledgers: Asia Express", "what_changed_zh": "Chainalysis 报告称，一名任务诈骗者因购买三台被篡改的 Ledger 设备而损失 60 BTC（约 480 万美元）；同一供应链攻击的链上被盗资金总额增至逾 1.034 亿美元，涉及 530 个地址。", "what_changed_en": "Chainalysis reported a task-scammer lost 60 BTC (~$4.8M) after buying three tampered Ledger devices; the same supply-chain attack's onchain theft total rose to over $103.4M across 530 addresses.", "current_state_zh": "Ledger 供应链植入事件中，Chainalysis 统计的链上被盗资金已超过 1.034 亿美元，涉及 530 个地址，并确认一名任务诈骗者因三台被篡改 Ledger 损失 60 BTC；Ledger 维持东南亚及香港经销商停售措施，Trezor 计划削减偏远地区经销商，调查与执法追踪持续。", "current_state_en": "In the Ledger supply-chain implant incident, Chainalysis tallies over $103.4M in onchain thefts across 530 addresses, including a task-scammer who lost 60 BTC via three tampered Ledgers; Ledger maintains reseller suspension across Southeast Asia and Hong Kong, Trezor plans to cut far-flung resellers, and investigation and law-enforcement tracing continue.", "detailed_summary_zh": "Chainalysis reports a task-scammer lost 60 BTC (~$4.8M) after buying three tampered Ledger devices that recorded seed phrases, part of a broader supply chain attack in which thieves drained over $103.4M from 530 addresses, prompting Ledger to suspend its reseller network across South East Asia.", "detailed_summary_en": "Chainalysis reports a task-scammer lost 60 BTC (~$4.8M) after buying three tampered Ledger devices that recorded seed phrases, part of a broader supply chain attack in which thieves drained over $103.4M from 530 addresses, prompting Ledger to suspend its reseller network across South East Asia.", "background_zh": "据BleepingComputer报道，此次篡改据称涉及一种混入正品硬件的间谍植入物，并未改动安全芯片或Ledger固件，因此Ledger的真伪校验（Genuine Check）仍然通过。助记词是恢复加密钱包的“主密钥”，因此记录助记词的设备会把资金控制权交给攻击者。此事发生在7月底Coldcard助记词风波之后。", "background_en": "The tampering reportedly involved a spy implant that blended into legitimate hardware without altering the secure chip or Ledger's firmware, so Ledger's Genuine Check still passed, according to BleepingComputer. A seed phrase is the master key that restores access to a crypto wallet, so a device that records it hands an attacker full control of the funds. The incident follows the Coldcard seed phrase debacle at the end of July.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "经销商停售使东南亚自托管硬件钱包这一细分市场的风险集中显现——依赖第三方经销商的买家若买到会记录助记词的被篡改设备，其资产的托管安全将直接暴露；Ledger称已确认盗窃仅限于亚洲，是主要的范围限定。另外，韩国屏蔽27家未注册交易所网站，是在应用之外进一步限制本国用户的网页访问渠道；泰国的ETF规则则为比特币和以太坊敞口打开了一条受监管的境内通道。", "market_impact_en": "The reseller suspension concentrates risk in the self-custody hardware wallet segment in South East Asia, where buyers relying on third-party resellers face custody exposure if a tampered device records their seed phrase; Ledger's statement limiting confirmed thefts to Asia is the main scope caveat. Separately, South Korea's move to block 27 unregistered exchange websites restricts domestic access through the web rather than apps, while Thailand's ETF rules open a regulated onshore channel for Bitcoin and Ether exposure.", "importance_score": 7.5, "references": [ { "url": "https://www.bleepingcomputer.com/news/security/ledger-confirms-hardware-wallet-spy-implant-behind-crypto-thefts/", "title": "Ledger confirms spy chip implant behind wallet crypto thefts" }, { "url": "https://crypto.com/en/university/seed-phrases-for-crypto-wallets", "title": "Seed Phrases for Crypto Wallets: How They Work to Protect ..." }, { "url": "https://ton-adoption.xyz/en/blog/hardware-wallet-supply-chain-risks-2026/", "title": "Hardware wallet supply-chain risks: TON guide 2026 — TON Adoption" } ], "confidence": 0.9, "story_ids": [ "rss:cointelegraph.com_rss:e939ff951424800d" ], "sources": [ { "url": "https://cointelegraph.com/magazine/scammer-loses-48m-stored-on-tampered-ledgers-asia-express?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_ceb9489d4a86cb98", "event_id": "evt_c594d0e29e7b400b", "occurred_at": "2026-10-16T00:52:47Z", "published_at": "2026-10-16T00:52:47Z", "first_seen_at": "2026-10-16T05:41:23.632033Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "【Ledger：某犯罪团伙耗资数百万美元在钱包内植入窃密组件】", "title_en": "【Ledger：某犯罪团伙耗资数百万美元在钱包内植入窃密组件】", "what_changed_zh": "Ledger披露，一个高度组织化的犯罪团伙花费数百万美元购买正版Ledger设备，植入隐藏组件以在初始化过程中窃取助记词，并通过东南亚分销商转售，促使Ledger暂停销售并更改东南亚和香港授权经销商的交付规则，同时与执法部门和SEAL 911合作追踪资金。", "what_changed_en": "Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds.", "current_state_zh": "Ledger披露，一个高度组织化的犯罪团伙花费数百万美元购买正版Ledger设备，植入隐藏组件以在初始化过程中窃取助记词，并通过东南亚分销商转售，促使Ledger暂停销售并更改东南亚和香港授权经销商的交付规则，同时与执法部门和SEAL 911合作追踪资金。", "current_state_en": "Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds.", "detailed_summary_zh": "Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds.", "detailed_summary_en": "Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:120548" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/115314", "label": "foresightnews", "source_type": "telegram", "official": false } ] } ] }