cryptobilis

According to an official post from Ledger, its security team Ledger Donjon is investigating Ledger signing devices sold by the Southeast Asian distributor CryptoBilis, which have been implanted with unauthorized hardware components. Ledger confirmed this matter on October 10 regarding a device belonging to an affected user. Donjon's analysis shows that the implant is located within the device's casing and can read the screen display content—decoding the 24-word recovery mnemonic during the initial setup and transmitting it externally via LTE through a built-in eSIM; this component does not alter the security chip, system, or transaction signature.Currently, all confirmed financial losses related to the incident disclosed on October 9 involve devices sold by CryptoBilis. CryptoBilis has stopped selling Ledger devices. The total number of affected users and the amount of losses have not yet been verified, and Ledger is investigating similar implant reports from other distributors and regions.

According to CoinDesk, several blockchain analysis companies estimate that the assets stolen by attackers from hundreds of wallets associated with the authorized dealer CryptoBilis sold Ledger devices could be as high as $94.5 million. Ledger has not yet confirmed this total.Hardware wallet company Ledger discovered that unauthorized hardware was implanted in at least one affected device; stablecoin issuer Tether has frozen $10 million USDT related to the theft, and investigators are still tracking the flow of funds. Ledger advises CryptoBilis customers not to set up devices that have not yet been used; customers who are already using the related devices should transfer their assets to new devices and generate new recovery phrases.

The founder of the hardware wallet brand OneKey, Yishi, stated that recently multiple users who purchased Ledger hardware wallets through CryptoBilis reported asset theft. Ledger has confirmed that affected devices were implanted with unauthorized hardware, and the cause and scope of the impact are still under investigation. Since CryptoBilis also sold hardware wallets from brands like OneKey, OneKey has terminated its authorized dealer qualifications and will stop adding new dealers effective immediately.OneKey will re-evaluate existing dealers, and those who cannot verify the operating entity or ultimate beneficiaries will have their authorization canceled. A complete list of authorized dealers will be published after the review is completed. From March 1, 2026, to the date of this announcement, users who purchased OneKey hardware wallets through CryptoBilis, regardless of model, activation status, or usage, can apply for a free replacement. If the original model is in stock, a brand new device of the same model will be provided; if out of stock, a free upgrade will be given, shipped directly from the official OneKey store without the need to return the old device. Applications will be accepted until December 31, 2026, and must be submitted through OneKey's official website customer service or help.onekey.so with proof of purchase, device model, and usage status.OneKey reminds users that unactivated devices should refrain from activation and apply for a replacement directly; users who have used the device and have assets should proactively treat the old mnemonic phrase as potentially compromised, and transfer assets to a wallet created with a brand new mnemonic phrase as soon as possible, and should not import the old mnemonic phrase into a new device.

Ledger Support released an update stating that it has confirmed the presence of unauthorized hardware implants in the device of one affected user. They are currently contacting the affected user and continuing to investigate the matter. Ledger is calling on anyone with information to provide leads and has stated that it is cooperating with relevant law enforcement agencies to hold those involved accountable. As a precaution, CryptoBilis has confirmed the suspension of sales of all hardware wallet inventory until the investigation is complete, and Ledger is actively communicating with them regarding follow-up measures.Ledger stated that there are currently no signs that its security infrastructure, systems, or services have been compromised. For users who purchased Ledger devices from this dealer, if the initialization setup has not yet been completed, it is advised not to start the setup; if the setup has been completed, they should consider transferring assets to a new Ledger signing device using new recovery phrases.Ledger emphasizes that security threats are constantly evolving, and the company is continuously improving security measures and advancing more sophisticated tamper-proof solutions. It also reminds users to be vigilant against scams that take advantage of this situation and to obtain the latest information only through official Ledger channels. Ledger will not ask users for their 24-word recovery phrase.

According to The Defiant, on-chain records of the Ethereum blockchain show that a wallet related to the CryptoBilis theft has transferred 464 ETH to the mixing protocol Tornado Cash.On-chain data indicates that these funds first passed through an intermediary address and were then dispersed to four deposit wallets, while the source address currently retains about 700 ETH.

Hardware wallet dealer CryptoBilis announced that, due to Ledger investigating a case involving fund losses for Southeast Asian users, the company has suspended all sales and shipments of Ledger devices and is cooperating with Ledger's investigation. Ledger previously stated that it is investigating reports of fund losses from Southeast Asian users who purchased products from this dealer, and as a precaution, has requested CryptoBilis to suspend the sales and shipments of related devices, advising users who purchased devices in the past 90 days not to set them up if they have not completed initialization.CryptoBilis reminds users who have completed setup to follow Ledger's advice and transfer their assets to a new Ledger signing device generated with a new mnemonic phrase. It emphasizes that the mnemonic phrase must be generated by the device during initialization and handwritten by the user; if the device comes with a pre-printed or written mnemonic card or paper, or if the mnemonic has been seen by others, the wallet should be considered unsafe, and users should not disclose their mnemonic phrase or PIN to anyone. The notice also warns to be cautious of third parties claiming to assist in recovering lost funds, as such proposals are often scams.For users who have already experienced fund losses, CryptoBilis recommends contacting their official customer service channels and providing the order number, purchase time and location, device serial number, affected wallet address, and transaction ID, while keeping the device and packaging, not resetting or discarding them, and suggests reporting to the police. The company stated that it will not send users links requesting them to connect wallets, input mnemonic phrases, or install software.

The Malaysian hardware wallet distributor CryptoBilis has been revealed to have changed ownership during the investigation into a suspected supply chain attack on Ledger devices. Newly disclosed company records show that an individual named Jiaming, with a registered address in Heilongjiang Province, China, has held 100% of the company's shares since August 3.The former co-founder of CryptoBilis confirmed that the company was acquired in March of this year, and the original shareholders subsequently withdrew from all operational, management, and administrative positions. The founding team has been unable to understand the actual operations of the company after the handover, only continuing to assist with some activity coordination, and stated that they are no longer part of the company, urging the current management to handle the matter transparently.As the change in ownership was exposed, CryptoBilis has come under scrutiny for its alleged involvement in the supply chain attack on Ledger hardware wallets, with related devices reportedly implanted with hidden modules capable of stealing recovery phrases. There is currently no conclusive evidence linking the change in ownership to the wallet theft incident. CryptoBilis has temporarily suspended sales and shipments of all brand hardware wallets at its stores and online channels in Malaysia, the Philippines, and Indonesia, and has closed offline stores until further notice.

The cryptocurrency hardware wallet manufacturer Ledger is investigating a theft incident involving Southeast Asian users, who had purchased devices through the distributor CryptoBilis.Ledger has requested CryptoBilis to suspend sales and shipments and advised users who purchased devices through this distributor in the past 90 days not to initialize their devices; if they have already completed the setup, they should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to the new wallet.On-chain investigator Specter estimates that this incident has led to the theft of hundreds of wallets on the Bitcoin, Ethereum, and TRON networks, with losses exceeding 86 million dollars. Security researcher tanuki42 previously estimated the losses to be over 72 million dollars and stated that the amount is still increasing. The specific cause of the incident and whether the involved devices have security vulnerabilities are still under investigation.