Ledger links draining cases to reseller devices

TLDR

Ledger says recent wallet-draining incidents are limited to hardware wallets sold through Southeast Asian reseller CryptoBilis, pointing to a reseller-side tampering problem rather than a core Ledger failure.

1. Ledger reports that all confirmed draining cases from the 9 Oct incident involve devices sold via CryptoBilis, while its own systems and direct sales channels remain unaffected.
2. At least one affected device contained an unauthorized hardware implant, with on chain loss estimates between about $86 million and $93 million, though Ledger has not confirmed a final figure.
3. The episode highlights supply chain risk for hardware wallets and makes it safer to favor official channels, fresh recovery phrases and upcoming Ledger advisories over informal reseller stock.

Deep Dive

1. Scope Of The Incident

Ledger has linked every confirmed case in the 9 Oct draining incident to devices sold through CryptoBilis, an authorized reseller serving Malaysia, Indonesia and the Philippines, saying that its own systems and directly sold products were not compromised. Multiple reports summarize Ledger's update that the number of impacted devices is "limited" but no exact count or official loss figure has been disclosed yet. Independent researchers and media estimate roughly $86 million to $93 million drained across hundreds of wallets holding assets such as Bitcoin, Ethereum, Tron and USDT, but those numbers come from third party analysis rather than Ledger itself.

2. How The Attack Worked

Investigators and hardware researchers have found at least one Ledger wallet from an affected user that contained an unauthorized hardware implant, a small circuit board hidden behind the screen that appears designed to capture the 24 word recovery phrase and transmit it out of the device. Reports describe several generations of these implants in devices bought via CryptoBilis, suggesting a planned supply chain attack that quietly bypassed normal firmware and secure element checks while leaving the official chip intact. Most losses hit in a short window around 9 to 10 Oct, with some stolen funds later routed through mixers and roughly $10 million in USDT reportedly frozen by Tether. Allegations that attackers may have bought the reseller itself remain unconfirmed and are not part of Ledger's official account.

3. Practical Steps And Signals

Ledger is advising anyone who bought through CryptoBilis not to initialize unused devices and, if a device is already in use, to migrate funds to a new wallet built on a freshly generated recovery phrase from a trusted device bought through official channels. More broadly, the company is tightening reseller controls and warning distributors never to restock returned hardware, since tampered stock could re enter circulation. For users, the key signals to watch are future Ledger advisories clarifying which models and batches were affected, whether any devices sold outside CryptoBilis are implicated and whether law enforcement or issuers can freeze more of the stolen funds.

Conclusion

Ledger's linking of all confirmed draining cases to CryptoBilis sold devices points to a reseller level hardware tampering campaign, not a general failure of Ledger's core technology. With tens of millions of dollars likely lost, the main lesson for crypto users is that where and how a hardware wallet is sourced is as critical as the brand itself, and upcoming clarifications on affected units and models will be important in deciding which devices can still be trusted.