Ledger Links Confirmed Wallet Losses to CryptoBilis Reseller

Ledger has linked every verified cryptocurrency wallet compromise in its ongoing supply-chain investigation to devices sold through Southeast Asian reseller CryptoBilis, raising wider concerns about hardware-wallet security.

In a 72-hour update issued Oct. 12, Ledger said its manufacturing infrastructure, internal systems and direct sales channels were not compromised. The company said the number of affected devices remains limited and that it is contacting impacted users while working with authorities and SEAL_911, a Web3 security coalition.

The investigation began after modified hardware was found inside devices sold through CryptoBilis, which operated across Malaysia, the Philippines and Indonesia. The alterations included a cellular modem, an embedded eSIM and a micro-antenna attached to the circuit board behind the OLED display. The components were designed to capture 24-word recovery seed phrases when generated and transmit them over cellular networks.

Reports from European markets have raised concerns about similar alterations at third-party retailers, but Ledger’s confirmed cases remain tied to CryptoBilis.

Ledger has instructed authorized distributors not to restock returned hardware and to obtain products through direct factory channels. Customers with uninitialized devices bought through CryptoBilis were told to keep them sealed, while users operating active devices from the reseller were instructed to move assets to a new address generated on an uncompromised signer.