Current outcome
Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds.
Progress timeline
47 material updates- #01
【Specter：数百个 Ledger 用户钱包疑似被盗，损失超 8600 万美元】
Chain analyst Specter reports that hundreds of Ledger users have had wallets drained across Ethereum, TRON and Bitcoin, with traced stolen funds exceeding $86 million.
Source evidence: foresightnews · theblockbeats · The Block · Cointelegraph · U.Today
- #02
【Ledger：正调查东南亚用户资金损失报告，涉事设备购自经销商 CryptoBilis】
Ledger is investigating reports of Southeast Asian users losing funds from devices bought via reseller CryptoBilis, has told the reseller to pause sales and shipping, and advises affected users to abandon a 90-day purchase window or migrate assets to a new device with a fresh seed phrase, as on-chain analysts estimate $72M–$86M+ drained from hundreds of Bitcoin, Ethereum and TRON wallets.
Source evidence: foresightnews · BitPinas · CoinDesk · theblockbeats · The Defiant · wublockchainenglish · Decrypt
- #03
⚡️CZ警告Ledger硬件钱包供应链攻击风险，疑似单一经销商出售假冒或遭篡改设备
CZ publicly warned Ledger hardware wallet users about supply-chain attack risk, saying the incident appears limited to one reseller (CryptoBilis) selling counterfeit or tampered devices, and called on BNB ecosystem and crypto industry to help track stolen funds.
State after update: Ledger is investigating the theft of funds from Southeast Asian users who bought devices via CryptoBilis, has told the reseller to pause sales and shipping; CZ publicly warned of supply-chain attack risk and called for industry help tracking stolen funds; on-chain estimates exceed $86M.
Source evidence: theblockbeats
- #04
⚡️Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT
A Ledger-related security incident has caused losses approaching $90 million, with MistTrack tracking the funds and Tether freezing substantial USDT in addresses tied to the event.
Source evidence: theblockbeats · foresightnews · The Defiant · theblockbeats
- #05
Many #Ledger users who bought their devices from reseller CryptoBillis have had
Lookonchain reports that one user (address TY24Ya) bought a Ledger device from reseller CryptoBilis three weeks ago and deposited 7M USDT, all of which was stolen about 10 hours before the report, possibly the largest single loss in the incident.
State after update: The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds, Tether freezing substantial USDT in related addresses, and a new possible largest victim losing 7M USDT.
Source evidence: lookonchainchannel · theblockbeats
- #06
🔍 链上侦探 | 某用户6月抄底80枚BTC浮盈138万美元，一周前存入Ledger现已全部被盗
Lookonchain reports another victim: a user bought 80 BTC about four months earlier for ~$5.2M, moved all BTC into a Ledger hardware wallet bought a week earlier from reseller CryptoBilis, and the entire balance was stolen; the case is linked to other CryptoBilis customer drains, though device tampering, attack method and attacker identity remain unconfirmed.
State after update: The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds, Tether freezing substantial USDT in related addresses, and a new possible largest victim losing 7M USDT; the latest report adds another victim who bought a Ledger from CryptoBilis and had 80 BTC drained, while device tampering and attacker identity remain unconfirmed.
Source evidence: theblockbeats · lookonchainchannel
- #07
Mt.Gox前CEO称发现被植入间谍模块的Ledger硬件钱包，可通过LTE发送助记词信息
Mt. Gox ex-CEO Mark Karpelès disclosed that a Ledger hardware wallet he received from Malaysia contained a hidden spy module with LTE, antenna, eSIM and a microcontroller wired to the device's SPI bus, capable of capturing displayed characters and exfiltrating seed phrases after setup, and urged users to follow Ledger's official device-verification guidance.
Source evidence: theblockbeats · theblockbeats · foresightnews
- #08
⚡️Ledger盗币黑客向Tornado Cash转入107万美元ETH，部分资金流入Binance热钱包
Suspects moved 430.2 ETH (~$1.07M) to Tornado Cash via 4 wallets, and after Tether's freeze converted USDT to USDD via SUN.io and the USDD PSM, with some funds routed to a Binance hot wallet; suspect wallets still hold ~$70.6M.
State after update: The Ledger-related supply-chain attack has confirmed losses approaching $90 million, with MistTrack tracking funds and Tether freezing substantial USDT; latest on-chain monitoring shows suspects moved 430.2 ETH (~$1.07M) to Tornado Cash and converted USDT to USDD via SUN.io and the USDD PSM, with some funds routed to a Binance hot wallet, while suspect wallets still hold ~$70.6M; device tampering and attacker identity remain unconfirmed.
Source evidence: theblockbeats
- #09
Ledger says Southeast Asia reseller linked to $86M draining
Ledger officially confirmed it is investigating a CryptoBilis-linked supply-chain compromise and told CryptoBilis to pause all sales and shipments of Ledger devices; users who bought devices from CryptoBilis in the past 90 days were advised not to initiate setup and, if already set up, to move assets to a new Ledger signer.
State after update: Ledger has officially confirmed it is investigating a CryptoBilis-linked supply-chain compromise, instructed the reseller to pause Ledger device sales and shipments, and advised affected users to migrate assets to a new signer; loss estimates range above $80M–$86M, with earlier on-chain tracking indicating ~$90M in related losses, Tether freezing some USDT, and suspects moving 430.2 ETH to Tornado Cash and converting USDT to USDD via SUN.io/USDD PSM; device tampering details and attacker identity remain unconfirmed.
Source evidence: Protos
- #10
Ledger hack scare nears $90 million as Tether moves to freeze stolen USDT
Industry figures publicly intervened: Binance founder Changpeng Zhao warned users and said the incident appears localized to a single-vendor supply-chain attack; former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware components were implanted in customer devices and asked CryptoBilis to open some unsold Ledger wallets for circuit-board inspection. Reports also note Ledger's Genuine Check verifies the Secure Element but may not detect physical modifications elsewhere in the hardware.
State after update: Ledger is investigating reported fund losses tied to Southeast Asian authorized reseller CryptoBilis; Ledger has asked CryptoBilis to suspend sales and shipments and warned customers who bought devices in the past 90 days. Onchain researchers estimate losses at roughly $72 million to $90 million, and Tether has frozen related USDT. Industry figures including Changpeng Zhao have publicly commented and called for industry help tracing funds, while Mark Karpelès is investigating whether malicious hardware components were implanted; the attack method, device tampering and attacker identity remain unconfirmed, and the investigation is ongoing.
Source evidence: CryptoSlate
- #11
【慢雾 CISO 推测 Ledger 设备被攻击路径：旁路录屏助记词后再外传】
SlowMist's CISO outlined how a tampered Ledger device could record the mnemonic words from the screen's SPI data lines and exfiltrate them via an embedded LTE/eSIM module, following Mark Karpelès' report of receiving a Ledger with a hidden spy module.
Source evidence: foresightnews · theblockbeats
- #12
【CryptoBilis 暂停三国全部品牌硬件钱包销售，目前正配合 Ledger 调查】
CryptoBilis has now suspended all hardware-wallet sales across its physical stores and online channels in Malaysia, the Philippines and Indonesia, temporarily closed physical stores, is cooperating with Ledger’s investigation and having independent experts review internal processes, with further updates expected within three business days.
State after update: Ledger is investigating reported fund losses tied to Southeast Asian authorized reseller CryptoBilis; CryptoBilis has now suspended all brand hardware-wallet sales in its physical stores and online channels in Malaysia, the Philippines and Indonesia, temporarily closed physical stores, and is cooperating with Ledger’s investigation while independent experts review its processes. Ledger had already asked CryptoBilis to suspend sales and shipments and warned customers who bought devices in the past 90 days. Onchain researchers estimate losses at roughly $72 million to $90 million, and Tether has frozen related USDT. The attack method, device tampering and attacker identity remain unconfirmed, and the investigation is ongoing.
Source evidence: foresightnews
- #13
BlockBeats pinned «📌律动10.10焦点关注 🔴Ledger安全事件损失接近9000万美元，Tether正冻结涉事地址中的大量USDT 🟠Le
A Ledger hardware-wallet compromise with losses near $90 million is drawing new forensic detail — a suspected supplier-side hardware implant used to extract seed phrases, distributor CryptoBilis's March ownership change, and Tether freezing substantial USDT in attacker-linked addresses.
Source evidence: theblockbeats · theblockbeats
- #14
⚡️OneKey分析Ledger硬件供应链攻击路径，提出硬件钱包五项改进措施
Following the suspected tampering of Ledger devices sold through CryptoBilis that led to roughly $90M in stolen assets, OneKey published an analysis of the hardware supply-chain attack path and announced five hardware-wallet improvements, including upgraded anti-tamper packaging, a screenless initialization flow, and firmware/hardware-level encryption of internal mainboard bus communications.
Source evidence: theblockbeats
- #15
‘Self-custody will die very quickly’ – Ledger wallet theft hits $91M
A Ledger-related wallet theft totaling about $91M has renewed debate over hardware-wallet security, with critics arguing the incident undermines the self-custody model.
Source evidence: AMBCrypto · wublockchainenglish
- #16
Ledger Says Affected User’s Device Contained Hardware Implant
Ledger has confirmed that an affected user's device contained a hardware implant, prompting reseller CryptoBilis to suspend sales of its entire hardware wallet inventory while the supply-chain investigation proceeds.
Source evidence: The Defiant · theblockbeats
- #17
【Ledger 确认一用户设备遭硬件植入，经销商 CryptoBilis 已停售硬件钱包】
Ledger confirmed an unauthorized hardware implant in one user's device bought from reseller CryptoBilis, which has halted all hardware wallet sales while investigators and SEAL 911 probe a theft scheme that drained over $86 million from victim wallets on Ethereum, TRON and Bitcoin.
Source evidence: foresightnews · Binance · theblockbeats
- #18
Ledger Confirms Unauthorized Hardware Implant in Impacted User's Device as CryptoBilis Halts Sales
Ledger confirmed that an impacted user's device contained an unauthorized hardware implant, prompting reseller CryptoBilis to halt sales of the affected hardware.
Source evidence: Binance
- #19
Ledger confirms unauthorized hardware implant; losses may exceed $86M
Ledger confirmed that a device bought from Southeast Asian reseller CryptoBilis contained an unauthorized hardware implant, part of an investigation into user losses estimated at over $86 million, with the reseller suspending all hardware wallet sales.
Source evidence: Cointelegraph
- #20
高风险Ledger经销商名单披露，CryptoBilis事件后区域供应链风险引发关注
After Ledger confirmed that Southeast Asian distributor CryptoBilis sold devices containing unauthorized hardware implants, an analyst published a speculative watch list of regionally adjacent Ledger resellers whose supply chains may also be affected, urging affected buyers to move assets to safety.
Source evidence: theblockbeats
- #21
Ledger confirms hardware implant attack, says systems not breached
Ledger said its own systems were not breached and the implant resulted from physical tampering; it advised affected users not to initialize unused devices and to move assets to wallets created with new recovery phrases.
State after update: Ledger confirmed an affected device contained an unauthorized hardware implant from physical tampering and said its own systems were not breached; reseller CryptoBilis has suspended hardware wallet sales, and Ledger advised affected users not to initialize unused devices and to move assets to wallets with new recovery phrases, with on-chain losses estimated above $86 million.
Source evidence: wublockchainenglish
- #22
【Ledger 供应链攻击据报扩展至欧洲，官方经销商售出硬件钱包发现间谍植入装置】
A Ledger hardware wallet bought weeks earlier from an official European reseller was found to contain an unauthorized spy implant with suspicious wiring not present in genuine units, indicating physical tampering before sale, with suspected cases now reported across Asia, South America and Europe and no funds stolen so far.
Source evidence: foresightnews · The Defiant
- #23
Ledger Says All Confirmed Draining Cases Involve CryptoBilis-Sold Devices
Ledger says every confirmed wallet-draining case traces back to devices sold by reseller CryptoBilis, stating its own direct sales channels are unaffected and warning resellers never to restock returned products.
Source evidence: The Defiant · theblockbeats · foresightnews · CoinDesk
- #24
OneKey宣布停止新增经销商，并为CryptoBilis渠道购买的用户免费更换硬件钱包
OneKey has revoked CryptoBilis's authorized-reseller status, halted new distributor appointments, and will replace for free any OneKey hardware wallet bought through CryptoBilis between March 1 and the announcement date, after tampered Ledger devices from that channel were tied to user asset thefts.
Source evidence: theblockbeats
- #25
Ledger wallet implant exposes a gap in its authenticity check
Independent investigators updated the suspected theft estimate to about $93.2 million across 315 wallets on six chains, and disclosed that Ledger's Genuine Check only verifies the secure element and cannot detect physical implants when that element remains intact; Tibane Labs also documented three generations of Nano X implants, though its specimens came from Japanese marketplaces rather than CryptoBilis.
State after update: The Ledger hardware wallet supply chain implant incident remains under investigation: Ledger confirmed an unauthorized hardware implant in one affected user's device, CryptoBilis has suspended all hardware wallet sales, and independent estimates put suspected losses at about $93.2 million across 315 wallets on six chains, while Genuine Check only verifies the secure element and cannot detect physical implants that leave it intact.
Source evidence: CryptoSlate
- #26
CZ Alleges Hackers Bought CryptoBilis as Ledger Probes Wallet Drains
CZ alleges that hackers acquired Ledger reseller CryptoBilis, while Ledger investigates wallet drains, with the reseller's former founders saying they handed over operations in March under an agreement that delayed public disclosure until mid-October.
Source evidence: The Defiant
- #27
Ledger claims CryptoBilis cases are limited as up to $93M is traced, $10M frozen
Tether froze $10 million in USDT tied to the Ledger hardware-wallet thefts; Bitquery said about $81 million was still traceable onchain as of Oct. 11 with some funds moved through Tornado Cash and Zcash; YFarmX gave a higher estimate of $94.5 million from 521 addresses across seven blockchains.
State after update: The Ledger hardware-wallet supply-chain implant and theft incident remains under investigation: Ledger confirmed an unauthorized hardware implant in at least one device and says all confirmed cases involve devices sold by CryptoBilis; independent estimates range from about $93.2 million across 315 wallets on six chains to $94.5 million across 521 addresses on seven chains, Tether has frozen $10 million in USDT, about $81 million remains traceable onchain, and some funds moved through Tornado Cash and Zcash; Ledger advised CryptoBilis customers not to set up unused devices and told those already using one to move assets to a new device with a newly generated recovery phrase.
Source evidence: CoinDesk · foresightnews
- #28
Bitquery Says $10 Million Frozen in CryptoBilis-Linked Wallet Drains
Bitquery estimates $93.2 million in losses across six chains from CryptoBilis-linked wallet drains, with about $10 million frozen; Ledger's latest update offers no repayment plan for affected buyers.
State after update: Bitquery estimates $93.2 million in losses across six chains from CryptoBilis-linked wallet drains, with about $10 million frozen, while Ledger investigates and offers no repayment plan to affected buyers.
Source evidence: The Defiant
- #29
Ledger spyware scare spreads beyond Southeast Asia
Ledger wallet tampering linked to CryptoBilis has spread beyond Southeast Asia, with spyware-fitted devices reported in Europe and South America, including from official resellers MediaMarkt (Germany) and LazMall (Philippines); Mark Karpelès identified spyware able to read screen output and bypass Ledger's Genuine Check; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices; former CryptoBilis CEO Arravind Prabu says the firm was acquired, he stepped down, and former staff signed a confidentiality clause.
State after update: The CryptoBilis-linked Ledger wallet drain incident now spans multiple regions, with spyware-tampered devices alleged in Asia, Europe, and South America; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices, losses exceed $86 million (Bitquery previously estimated $93.2 million with about $10 million frozen), Ledger continues to investigate and offers no repayment plan to affected buyers; former CryptoBilis CEO says the firm was acquired and he stepped down.
Source evidence: Protos
- #30
Karpelès Flags Another Ledger Implant as Company Keeps CryptoBilis Warning
Ledger's security documentation acknowledges that its Genuine Check verification cannot detect spying implants that leave the secure chip untouched, as co-founder Karpelès flags another implant and the company's CryptoBilis warning remains in force.
Source evidence: The Defiant
- #31
OneKey Cuts Off CryptoBilis, Offers Free Wallet Replacements
OneKey's free replacement program now explicitly includes used devices and sets a claim deadline of Dec. 31; the eligibility window for OneKey devices bought through CryptoBilis is March 1 to Oct. 12.
State after update: The Ledger hardware-wallet supply-chain implant and theft incident remains under investigation; OneKey has revoked CryptoBilis's authorized-reseller status and halted new distributor appointments, and has expanded its free replacement program: any OneKey device bought through CryptoBilis between March 1 and Oct. 12, including used units, qualifies for free replacement, with claims due by Dec. 31.
Source evidence: The Defiant
- #32
Buyer Reports Second Tampered Ledger From MediaMarkt, Calls for Recall
A buyer reports a second tampered Ledger device from MediaMarkt, names distributor Aqipa, calls for a recall, and sends the device to Ledger for analysis.
State after update: The CryptoBilis-linked Ledger wallet drain incident now spans multiple regions, with spyware-tampered devices alleged in Asia, Europe, and South America; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices, losses exceed $86 million (Bitquery previously estimated $93.2 million with about $10 million frozen), Ledger continues to investigate and offers no repayment plan to affected buyers; former CryptoBilis CEO says the firm was acquired and he stepped down; a buyer reports a second tampered Ledger device from MediaMarkt, names distributor Aqipa, calls for a recall, and sends the device to Ledger for analysis.
Source evidence: The Defiant · theblockbeats · theblockbeats
- #33
Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis
Ledger's 72-hour update says every confirmed case in the wallet-draining incident involves hardware wallets sold by reseller CryptoBilis; CryptoBilis has ceased all hardware wallet sales; Ledger says its own systems and direct channels are unaffected, is working with authorities, and reminds authorized resellers never to restock returned products.
State after update: The CryptoBilis-linked Ledger wallet drain incident now spans multiple regions, with spyware-tampered devices alleged in Asia, Europe, and South America; Ledger confirmed the October 9 incident affected a limited number of CryptoBilis devices, losses exceed $86 million (Bitquery previously estimated $93.2 million with about $10 million frozen), Ledger continues to investigate and offers no repayment plan to affected buyers; former CryptoBilis CEO says the firm was acquired and he stepped down, and CryptoBilis has ceased all hardware wallet sales; in a 72-hour update, Ledger said all confirmed cases involve CryptoBilis devices, its own systems and direct channels are unaffected, it is working with authorities, and it warned resellers not to restock returned products; a buyer reports a second tampered Ledger device from MediaMarkt, names distributor Aqipa, calls for a recall, and sends the device to Ledger for analysis.
Source evidence: Decrypt
- #34
Ledger确认经销商CryptoBilis设备遭硬件植入，助记词被LTE外传
Ledger's security team released the latest investigation update on the hardware implant incident, confirming that some Ledger devices sold by CryptoBilis contained unauthorized hardware implanted inside the casing that can read the screen and capture the 24-word seed phrase during initialization, then exfiltrate it over LTE via an embedded microcontroller and eSIM; the component does not modify the Secure Element or Ledger OS and does not interfere with transaction signing. Ledger also said it has not confirmed the total number of affected users or loss amount, and circulating online figures are unverified.
State after update: Ledger has confirmed hardware implants in CryptoBilis-channel devices; the implant reads the screen to capture the 24-word seed phrase during initialization and exfiltrates it over LTE/eSIM without touching the Secure Element or transaction signing; all confirmed losses from the October 9 incident are linked to CryptoBilis-channel devices, while other channels remain unverified; CryptoBilis has suspended sales of Ledger products; Ledger says the total affected-user count and loss amount are not yet confirmed, online figures are unverified, and it advises users not to initialize uninitialized devices and for already-configured users to move assets and generate new seed phrases; the investigation continues.
Source evidence: theblockbeats · foresightnews
- #35
Ledger details LTE-enabled spy implants in wallets sold by CryptoBilis
Ledger detailed how malicious LTE-enabled implants embedded in Ledger hardware wallets sold by reseller CryptoBilis captured users' 24-word recovery phrases via an eSIM and transmitted them over cellular networks, prompting CryptoBilis to halt sales and Trezor and OneKey to cut ties with the reseller.
Source evidence: Cointelegraph · CoinDesk
- #36
新加坡机场所购Ledger Flex被确认植入间谍模块，硬件钱包供应链风险扩大
Mark Karpelès confirmed via teardown images and video that a Ledger Flex purchased at Singapore airport's Metapod contained an implanted board and wiring that could steal the user's seed phrase, the latest evidence of an expanding hardware-wallet supply-chain compromise.
Source evidence: theblockbeats
- #37
MediaMarktSaturn pulls Ledger products amid tampering reports
MediaMarktSaturn has removed all Ledger products from its stores and online platforms and is in contact with the manufacturer; this follows a buyer reporting two Ledger wallets purchased from separate MediaMarkt stores containing unauthorized cables and cellular modules, widening the investigation beyond CryptoBilis.
State after update: Ledger has confirmed hardware implants in CryptoBilis-channel devices; the implant reads the screen to capture the 24-word seed phrase during initialization and exfiltrates it over LTE/eSIM without touching the Secure Element or transaction signing; all confirmed losses are linked to CryptoBilis-channel devices, while other channels are being investigated; CryptoBilis has suspended sales of Ledger products; MediaMarktSaturn has removed all Ledger products from its stores and online platforms and is in contact with the manufacturer; Ledger says the total affected-user count and loss amount are not yet confirmed, online figures are unverified, and it advises users not to initialize uninitialized devices and for already-configured users to move assets and generate new seed phrases; the investigation continues.
Source evidence: Cointelegraph · foresightnews · theblockbeats
- #38
Ledger审查设备销售政策和流程，评估设备防篡改保护措施
Ledger CTO Charles Guillemet said the company is reviewing its consumer device sales policies and processes and assessing device tamper-resistance protections; it also urged users not to open suspicious hardware wallets themselves but to send them to Ledger for inspection. The report also mentioned an estimated $90 million in crypto stolen in the spyware-planting incident.
State after update: Ledger is reviewing its consumer device sales policies and processes and assessing tamper-resistance protections, with its CTO advising users not to open suspicious wallets; the investigation has widened to channels such as MediaMarktSaturn, CryptoBilis halted sales, Trezor and OneKey cut ties, and estimated losses are around $90 million.
Source evidence: theblockbeats
- #39
Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain
Ledger's Donjon security team confirmed an unauthorized hardware implant in wallets sold by Southeast Asian reseller CryptoBilis that reads the 24-word recovery phrase from the device screen during setup and transmits it over LTE via a provisioned eSIM, with all confirmed losses from the suspected $86M drain tied to devices bought through that reseller.
Source evidence: Decrypt
- #40
Ledger：MediaMarkt暂停销售源于德国用户报告发现植入物，暂无资金损失
New: Ledger officially confirmed it coordinated with MediaMarkt Saturn to suspend online and in-store sales in Germany pending investigation into a German user's suspected implant report; Ledger said there were no reported fund losses tied to that report and no signs of compromise to its infrastructure, systems, or services, with customer support reviewing the report and Donjon set to inspect devices.
State after update: The incident remains under monitoring; Ledger has coordinated with German retailer MediaMarkt Saturn to suspend online and in-store sales while investigating a German user's suspected implant report. Ledger said there were no reported fund losses tied to that report and no signs of compromise to its infrastructure, systems, or services, with customer support and Donjon reviewing the report and inspecting devices. The previously confirmed CryptoBilis reseller device implants and suspected $86M drain remain part of the same supply-chain security incident.
Source evidence: theblockbeats
- #41
German Ledger reseller pauses sales following $86M draining incident
The new report says Mark Karpelès has also found spyware in Ledger wallets sold by official Philippine reseller LazMall, further widening the affected-reseller scope; Ledger’s latest statement says it has not verified a drain linked to a signer bought elsewhere and is reviewing reports of implants in other signers and locations, while CryptoBilis remains not selling wallets during the investigation.
State after update: The incident remains under monitoring; the confirmed implant and suspected $86M drain remain tied to devices sold by CryptoBilis, which is not selling wallets during the investigation; MediaMarkt Saturn has suspended online and in-store Ledger sales in Germany; Karpelès’s teardowns also point to wallets sold by MediaMarkt, Singapore’s Metapod, and official Philippine reseller LazMall; Ledger says it has not verified a drain linked to devices bought elsewhere and is reviewing implant reports from other resellers and locations.
Source evidence: Protos
- #42
Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto Wallets
After Ledger's Donjon team confirmed a spy implant in hardware wallets sold via reseller CryptoBilis that captures seed phrases and exfiltrates them over LTE — with $86M in suspected thefts traced onchain — Trezor moved to cut its own authorized reseller network by January 1, 2027 as a precaution.
Source evidence: Decrypt
- #43
Ledger asks resellers to halt sales in Southeast Asia and Hong Kong
Ledger requested resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales and remove its hardware wallets from shelves while it investigates device tampering; this expands on the earlier request for reseller CryptoBilis to halt sales and shipments.
State after update: Ledger has expanded its sales suspension request to resellers in six Southeast Asian countries and Hong Kong, with devices removed from shelves and the investigation ongoing; Ledger says confirmed incidents remain contained to Southeast Asia and it has not verified a drain linked to a device bought elsewhere.
Source evidence: Cointelegraph · theblockbeats · foresightnews · Protos · Decrypt
- #44
Ledger回应硬件植入攻击：属局部分销渠道攻击，要求东南亚及香港授权渠道暂停销售
Ledger formally characterized the incident as a localized distribution-channel attack after devices left its control, rather than a systemic supply-chain compromise, saying its chips, OS, and servers were not breached; it also tightened channel rules — returned devices cannot be resold even if seemingly new or unopened, products must not be displayed on shelves and must be stored in backrooms and delivered at purchase, and channels must promptly report anomalous products; Ledger added it bought and inspected devices at stores in Germany and elsewhere and checked warehouses and its own inventory samples without finding tampering, while working with law enforcement to trace funds.
State after update: Ledger has characterized the incident as a localized distribution-channel attack after devices left its control, requiring authorized resellers in Southeast Asia and Hong Kong to suspend sales and follow stricter return, storage, and reporting rules; inspections of devices from stores in Germany and elsewhere and warehouse samples found no tampering, with its chips/OS/servers uncompromised and investigation and law-enforcement tracing ongoing.
Source evidence: theblockbeats · foresightnews
- #45
Ledger: Organized Syndicate Infiltrated Supply Chain for Months to Implant Malic
Ledger disclosed that an organized syndicate spent months implanting malicious hardware into genuine Ledger devices and redistributing them through Southeast Asian resale channels to intercept seed phrases and drain user assets, while confirming its secure element chips, BOLOS OS, and server infrastructure were not compromised.
Source evidence: wublockchainenglish
- #46
Scammer loses $4.8M stored on tampered Ledgers: Asia Express
Chainalysis reported a task-scammer lost 60 BTC (~$4.8M) after buying three tampered Ledger devices; the same supply-chain attack's onchain theft total rose to over $103.4M across 530 addresses.
State after update: In the Ledger supply-chain implant incident, Chainalysis tallies over $103.4M in onchain thefts across 530 addresses, including a task-scammer who lost 60 BTC via three tampered Ledgers; Ledger maintains reseller suspension across Southeast Asia and Hong Kong, Trezor plans to cut far-flung resellers, and investigation and law-enforcement tracing continue.
Source evidence: Cointelegraph
- #47
【Ledger：某犯罪团伙耗资数百万美元在钱包内植入窃密组件】
Ledger disclosed that a highly organized criminal group spent millions of dollars buying genuine Ledger devices, implanting hidden components to steal seed phrases during initialization and reselling them via Southeast Asian distributors, prompting Ledger to suspend sales and change delivery rules at authorized resellers in Southeast Asia and Hong Kong while it works with law enforcement and SEAL 911 to trace the funds.
Source evidence: foresightnews