#LedgerResellerSecurity
About LedgerResellerSecurity
Ledger says confirmed theft cases so far involve devices sold by Southeast Asian reseller CryptoBilis, with few devices affected. It confirmed an unauthorized implant in one device and says its systems and direct sales show no signs of compromise. Researchers estimate over $86M in suspected losses, but the total and any link to the implant remain unverified. A European buyer also reported a suspicious component in a reseller device; this claim is unverified. Is the risk confined to one channel?
رائج
الأحدث
LedgerResellerSecurity المنشورات الشائعة
A "COLD" WALLET WITH A CELLULAR SIGNAL. 📡
Ledger says a hidden chip in some devices sold by reseller CryptoBilis read users' 24-word recovery phrases during setup and sent them over LTE via eSIM.
The Secure Element wasn't breached. The supply chain was.
Onchain analysts estimate $86M+ in suspected losses; Ledger hasn't verified that total.
CryptoBilis buyers: don't initialize unused devices. Already used one? Move funds to a new wallet with a NEW recovery phrase.
#CryptoSecurity #DailyOrbit
$BTC SECURITY UNDER THREAT.
A modified Ledger hardware wallet containing an extra chip hidden beneath its screen has been linked to over $86M in losses. A device designed to protect crypto became the point of attack. Even more concerning, some altered units reportedly pass the Genuine Check because the original secure chip remains untouched.
#DailyOrbit
#Ledger Investigation Update: The Theft Is Temporarily Concentrated in a Single Channel
The boss has something to say
The latest update on the Ledger investigation is out. The theft cases are concentrated at the Southeast Asian distributor CryptoBilis; no breaches have been found in the official direct sales channels. However, a European user reported that devices bought from a local authorized dealer also contained suspicious components.
One uncomfortable lesson from the reported Ledger reseller incident: buying a hardware wallet is not the same as guaranteeing security.
Ledger is investigating reports of losses involving devices sold through a reseller, and the full cause and scale have not been confirmed.
For self-custody, your security routine matters as much as the device: verify the source, protect your recovery phrase, and never enter it on an untrusted website.
Would you buy a hardware wallet from an unknown reseller?
money from the ledger wallet drains, which hit buyers from reseller cryptobilis, now reaches binance. on october 10 the attacker swapped 5.1m usdd back to usdt and paid five otc brokers. those brokers sent 5.2m usdt to three binance addresses. binance records can identify the accounts, but binance freezes funds only with a police or court order. the brokers also serve other clients, so the stolen share is unknown.
they didn’t hack ledger. they didn’t exploit the code. they BOUGHT the company selling you the device. $86 million gone
a company called CryptoBilis was an authorized ledger reseller in southeast asia. trusted. legit. sold ledgers for years
a random chinese company quietly bought CryptoBilis from its malaysian owner
made the original owner sign a confidentiality agreement. he couldn’t tell anyone the company was sold
same brand name. same website. same “authorized reseller” badge. but different people behind it now
the new owners started opening every ledger device before shipping
soldered a tiny spy chip onto the board inside. repackaged it. sealed the box. shipped it
the device looked normal. felt normal. worked normal
but the spy chip was silently capturing your private keys the moment you set it up
your seed phrase was sent to the attacker before you even finished writing it down
hundreds of wallets across ethereum tron and bitcoin. all drained
the guy who lost $5.3 million said “i did everything right. no leverage. no memecoins. i stored my funds on a hardware wallet like we’re all told to”
he was right. he did everything right
except his device had a parasite inside it that he couldn’t see
ledger has now told CryptoBilis to stop all sales. told recent buyers NOT to set up their devices
mark karpelès posted photos of the implant. normal board on top. spy chip below
the most dangerous attack in crypto this year wasn’t a line of code
it was a business acquisition
Key News
· 10/10 Crash Anniversary: One year after 70B before the crash to ~$30B by mid-December 2025.
· Ledger Security Fallout: A suspected Ledger reseller hack saw 93.4M in crypto stolen. Hardware wallet manufacturer Ledger launched an investigation; reseller CryptoBilis suspended all sales in Malaysia, Philippines, and Indonesia.
· Hacker Shorts $BTC with 40x Leverage: A wallet received 263 ETH from Tornado Cash, sold it for $643K USDC, and deposited into Hyperliquid to short 305.5
Hashmeta_x
Crypto markets are showing a modest rebound today, with $BTC holding above $82,500 after a brutal week of liquidations. The Fear & Greed Index climbed back to 64 (Greed) from 59 yesterday, signaling sentiment is recovering, though Treasury yields near 5.25% continue to cap upside.
THE BLOCK: Ledger has requested resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to halt sales and remove products from shelves while the investigation continues.
Ledger said confirmed fund drains remain limited to Southeast Asia and that it has not verified any losses tied to devices purchased elsewhere.
The Block
UPDATE: Ledger said all confirmed fund losses in the CryptoBilis incident involve signers sold by the Southeast Asian reseller, while noting it has not confirmed the total number of affected users or the total value lost.
Its Donjon team found an unauthorized implant that reads recovery phrases displayed during setup and transmits them over LTE.
