Ledger Says All Confirmed Fund-Draining Cases Involve CryptoBilis-Sold Devices

Ledger narrows scope of fund-draining incident

Hardware-wallet maker Ledger said on Oct. 11 that every confirmed case in its recent fund-draining incident involved devices sold through a Southeast Asian reseller called CryptoBilis. The company said its own systems and direct sales channels were not affected.

Ledger described the volume of impacted devices as "limited" but did not provide a device count or loss figure.

Key facts from Ledger's statement

• All confirmed draining cases involve devices sold by CryptoBilis.
• Ledger's direct sales channels and internal systems are unaffected.
• One affected user's device contained what Ledger Support described as an "unauthorized hardware implant."
• Ledger is reviewing authorized-reseller controls and working on hardware protections.
• CryptoBilis has stopped all hardware-wallet sales until the investigation concludes.

What the official update says

Ledger posted the update on X on Oct. 11, following a separate Oct. 10 confirmation from Ledger Support that one affected device contained a hardware implant. Neither update explained how the implant worked or how it enabled fund draining.

CryptoBilis appeared in Ledger's authorized reseller directory for Malaysia and Indonesia. Ledger also reminded authorized resellers and distributors to source products only through authorized channels and to "never restock returned products." The statement did not say that returned stock was the route through which the tampered device entered the supply chain.

What is confirmed

All confirmed fund-draining cases trace back to devices sold by CryptoBilis, a reseller listed in Ledger's directory. Ledger's direct channels and systems were not affected. One device contained an unauthorized hardware implant. CryptoBilis has paused all wallet sales.

What is still unclear

Ledger did not provide a device count, total loss figure, or explanation of how the hardware implant functioned. It also did not identify how the tampered device entered the supply chain — whether through returned stock, a manufacturing issue, or another route. The scope of the incident may expand if more cases come forward.

What Ledger advises CryptoBilis buyers

For unused devices purchased through CryptoBilis, Ledger told buyers not to initialize them. For devices already set up, the company advised moving to a new seed — a new recovery phrase — on a device obtained directly from Ledger.

This step matters because restoring the same recovery phrase on another device recreates the same private keys and crypto accounts. Swapping hardware alone without changing the seed does not change those keys.

Ledger said it is working with authorities and encouraged affected users to contact official Ledger Support and file complaints with local law enforcement. The company also warned that scammers may exploit the incident — Ledger said it will never call, send a direct message, or ask a customer for their 24-word recovery phrase.

Sources

• The Defiant

Read also: Ledger Investigates Possible $86 Million Crypto Theft Linked to Reseller Devices

Read also: PeckShield Links $3.89 Million in Ledger Theft Funds to Binance Deposits

Read also: Ledger Confirms Unauthorized Hardware Implant in Compromised Device, Estimated Losses Exceed $86 Million

Read also: European Reseller MediaMarkt Linked to Implanted Ledger Wallet, Raising New Questions