#LedgerResellerSecurity
About LedgerResellerSecurity
Ledger says confirmed theft cases so far involve devices sold by Southeast Asian reseller CryptoBilis, with few devices affected. It confirmed an unauthorized implant in one device and says its systems and direct sales show no signs of compromise. Researchers estimate over $86M in suspected losses, but the total and any link to the implant remain unverified. A European buyer also reported a suspicious component in a reseller device; this claim is unverified. Is the risk confined to one channel?
Veelbesproken
Laatste
LedgerResellerSecurity Populaire berichten
#Ledger Investigation Update: The Theft Is Temporarily Concentrated in a Single Channel
The boss has something to say
The latest update on the Ledger investigation is out. The theft cases are concentrated at the Southeast Asian distributor CryptoBilis; no breaches have been found in the official direct sales channels. However, a European user reported that devices bought from a local authorized dealer also contained suspicious components.
money from the ledger wallet drains, which hit buyers from reseller cryptobilis, now reaches binance. on october 10 the attacker swapped 5.1m usdd back to usdt and paid five otc brokers. those brokers sent 5.2m usdt to three binance addresses. binance records can identify the accounts, but binance freezes funds only with a police or court order. the brokers also serve other clients, so the stolen share is unknown.
AN UNINVITED GUEST INSIDE A COLD WALLET.
Ledger confirmed an unauthorized hardware implant in one affected customer’s device.
It’s investigating reported losses among CryptoBilis buyers in Southeast Asia. On-chain analysts estimate over $86M stolen; Ledger has not confirmed the figure or cause.
Bought there in the past 90 days? Ledger advises against setting up unused devices.
A security breach may begin long before the first transaction.
#LedgerResellerProbe
A hardware wallet is only one part of crypto security.
Ledger is investigating reported losses involving devices purchased through a Southeast Asian reseller. The cause and full scale of the incident have not been confirmed.
The lesson is bigger than any single brand: where you buy a device, how you verify it, and how you protect your recovery phrase all matter.
Never share your seed phrase with anyone.
Do you buy hardware wallets directly from manufacturers or through resellers?
they didn’t hack ledger. they didn’t exploit the code. they BOUGHT the company selling you the device. $86 million gone
a company called CryptoBilis was an authorized ledger reseller in southeast asia. trusted. legit. sold ledgers for years
a random chinese company quietly bought CryptoBilis from its malaysian owner
made the original owner sign a confidentiality agreement. he couldn’t tell anyone the company was sold
same brand name. same website. same “authorized reseller” badge. but different people behind it now
the new owners started opening every ledger device before shipping
soldered a tiny spy chip onto the board inside. repackaged it. sealed the box. shipped it
the device looked normal. felt normal. worked normal
but the spy chip was silently capturing your private keys the moment you set it up
your seed phrase was sent to the attacker before you even finished writing it down
hundreds of wallets across ethereum tron and bitcoin. all drained
the guy who lost $5.3 million said “i did everything right. no leverage. no memecoins. i stored my funds on a hardware wallet like we’re all told to”
he was right. he did everything right
except his device had a parasite inside it that he couldn’t see
ledger has now told CryptoBilis to stop all sales. told recent buyers NOT to set up their devices
mark karpelès posted photos of the implant. normal board on top. spy chip below
the most dangerous attack in crypto this year wasn’t a line of code
it was a business acquisition
Key News
· 10/10 Crash Anniversary: One year after 70B before the crash to ~$30B by mid-December 2025.
· Ledger Security Fallout: A suspected Ledger reseller hack saw 93.4M in crypto stolen. Hardware wallet manufacturer Ledger launched an investigation; reseller CryptoBilis suspended all sales in Malaysia, Philippines, and Indonesia.
· Hacker Shorts $BTC with 40x Leverage: A wallet received 263 ETH from Tornado Cash, sold it for $643K USDC, and deposited into Hyperliquid to short 305.5
Hashmeta_x
Crypto markets are showing a modest rebound today, with $BTC holding above $82,500 after a brutal week of liquidations. The Fear & Greed Index climbed back to 64 (Greed) from 59 yesterday, signaling sentiment is recovering, though Treasury yields near 5.25% continue to cap upside.
🚨 $86M+ IN CRYPTO REPORTEDLY STOLEN — THROUGH A HARDWARE WALLET SUPPLY-CHAIN ATTACK.
This is the kind of security nightmare crypto users rarely expect.
A reseller in Southeast Asia, CryptoBilis, was linked to reports of drained Ledger wallets. The shocking part? Ledger confirmed that at least one affected device contained an unauthorized hardware implant.
🔎 What we know so far:
• On-chain investigators estimate losses exceeding $86M across Bitcoin, Ethereum, and Tron. Some later estimates are even higher.
• Ledger asked CryptoBilis to suspend sales and shipments while the investigation continues.
• The suspected attack involves hardware tampering before devices reached customers.
• The exact mechanism, total number of victims, and final losses remain under investigation.
⚠️ Important distinction: The discovery of an implant in one device does NOT prove that every wallet sold by the reseller was compromised, or that every device contained a spy chip.
My take: This incident exposes a brutal weakness in self-custody: protecting your seed phrase means little if the device you trust has already been compromised before you open the box.
“Not your keys, not your coins” is only half the story. Where your keys come from matters, too.
🛡️ If you purchased a Ledger through CryptoBilis within the past 90 days, follow Ledger’s official security guidance. Do not initialize an unused device; if you've already used it, consider moving funds to a new device with a freshly generated recovery phrase. Never reuse the old seed.
Would you still trust an “authorized reseller” after an incident like this?
JUST IN: Changpeng Zhao (CZ) questions reports of Ledger wallet drainings tied to Southeast Asian reseller
The Binance co-founder alleges hackers may have taken over CryptoBilis and used an NDA to silence it, even as Ledger confirmed the affected devices came through the reseller and its own systems and direct sales remain unaffected.
