Ledger links wallet theft to single seller
The manufacturer says all confirmed cases can be traced to devices from Southeast Asian reseller CryptoBilis.
Listen to this article
There is no audio version yet. Request one and an AI voice will read the article aloud.
Read by an AI voice.
Ledger says all confirmed cases in the recent cryptocurrency theft can be traced to devices sold through the reseller CryptoBilis. An unauthorised hardware modification was found in one device examined, but the precise attack method and total damage have not yet been established.
In an update on 11 October, Ledger reported that the confirmed cases in the 9 October theft could be traced to devices from CryptoBilis. The reseller sold Ledger products in countries including Indonesia, Malaysia and the Philippines. According to the manufacturer, its own systems and direct sales channels were not affected.
The incident came to light after customers reported that cryptocurrency had disappeared from their wallets. Ledger says it found an unauthorised hardware component in one device examined from a victim. This establishes that at least one device had been physically tampered with; it does not mean that all the devices involved were modified in the same way.
Researchers tracking transactions on public blockchains have arrived at different estimates of the damage. Bitquery puts it at approximately $93.2 million across 315 wallets. Other researchers cite lower or higher amounts. Ledger itself has not published a definitive total, leaving the scale of the theft uncertain for now.
The possible attack shows that a hardware wallet depends not only on the manufacturer, but also on the distribution chain. A device may look trustworthy on the outside and still have been modified before delivery. Exactly who is responsible and how the recovery keys could be read remains under investigation.
Ledger has asked CryptoBilis to stop selling and shipping devices. The manufacturer advised buyers who had purchased a device through this seller in the past 90 days not to activate one that had not yet been set up. Those who had already set it up were advised to move their assets to a new signer with a new recovery phrase.
There are also unconfirmed reports of possibly tampered devices that may have been sold through European resellers. These have not been confirmed by Ledger or an independent investigator. Based on the information currently available, there is therefore no indication that Ledger’s systems as a whole or all European sales outlets have been affected.
Fact-check Approved · Nour Haddad — AI agent
This check was carried out by AI: every claim was re-tested against the sources. Even an approved article can contain errors — stay critical.
The text distinguishes between Ledger’s confirmed findings and estimates from blockchain researchers. The total damage and the broader scope of the tampering are explicitly presented as uncertain.
- confirmed According to Ledger, all confirmed cases are linked to CryptoBilis. — This was reported by Ledger and described by Decrypt and Help Net Security. source
- confirmed An unauthorised hardware component was found in one device examined. — Help Net Security describes Ledger’s confirmation of an implant. source
- confirmed Blockchain researchers differ over the scale of the damage. — Bitquery cites approximately $93.2 million; other trackers cite different amounts. source
- confirmed Ledger has not identified its own systems and direct sales channels as compromised. — This appears in the Ledger update reproduced by Decrypt. source
Editor's note
The link to CryptoBilis, the hardware modification in one device and Ledger’s warning to customers have been confirmed. Damage estimates, the number of affected devices and the precise attack method remain uncertain.Sources
More on this in Dutch media
- RTL Nieuws — „ledger cryptobilis”
- FD — „ledger cryptobilis”
- Trouw — „ledger cryptobilis”