Ledger (@Ledger) says confirmed cases of its October 9 draining incident involve devices sold through Southeast Asian reseller CryptoBilis. The hardware wallet maker says its own systems and
Ledger (@Ledger) says confirmed cases of its October 9 draining incident involve devices sold through Southeast Asian reseller CryptoBilis. The hardware wallet maker says its own systems and direct sales channels remain unaffected.
According to U.Today, the French company said in an October 11 statement that the volume of impacted devices is limited, without specifying how many wallets were compromised. Ledger says it is working with the relevant authorities, and reports indicate CryptoBilis has already stopped selling hardware wallets.
Ledger's guidance depends on whether a device has been set up. Users who have not yet initialized their devices should refrain from doing so. Those who have initialized them should move their coins to a new seed on a Ledger device.
The original advice was issued on October 9. Forklog reported that it applied to customers who bought a device from CryptoBilis in the last 90 days. The report also said CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.
The incident has moved from a suspected compromise to a confirmed case of physical tampering. BitBase reported that Ledger found an unauthorized hardware implant in one affected customer's device, which raised concerns that some wallets were altered before delivery. Investigators are still working out whether the same change caused all the reported thefts.
Loss figures come from independent analysts rather than Ledger. Inside Bitcoins reported estimates of more than $72 million from tanuki42, above $86 million from Specter and almost $90 million from MistTrack. Ledger has not confirmed a dollar amount. Blockchain analytics firm Bitquery has traced about $93.2 million drained from 315 wallets across six networks, including Bitcoin ($BTC), Ethereum ($ETH) and Tron ($TRX), according to BigGo Finance. Ledger has not verified that figure.
The case is not fully closed on scope. The Crypto Times reported that a researcher has separately reported a possibly tampered device bought in Europe, while a claim about the reseller's acquisition remains unverified.
The episode highlights the risk of buying hardware wallets through third-party sellers. Ledger's own guidance, as relayed in the reports above, is to treat any device with unexpected signs of tampering with caution and to migrate funds to a fresh seed if there is doubt.
Sources:
