Ledger and the CryptoBilis device-draining incident: what is confirmed, what Ledger has said, and what remains under investigation. Ledger says every confirmed case in the October 9 incident involved a device sold through CryptoBilis, a Southeast Asian reseller. It confirmed an unauthorized hardware implant in one impacted user’s device, while saying its systems and direct sales channels remain unaffected. The reported $93 million loss and the implant’s role in the thefts have not been established by Ledger’s statements.

Ledger and the CryptoBilis device-draining incident: what is confirmed, what Ledger has said, and what remains under investigation. Ledger says every confirmed case in the October 9 incident involved a device sold through CryptoBilis, a Southeast Asian reseller. It confirmed an unauthorized hardware implant in one impacted user’s device, while saying its systems and direct sales channels remain unaffected. The reported $93 million loss and the implant’s role in the thefts have not been established by Ledger’s statements.

Ledger’s updates

On October 10, Ledger confirmed one impacted user’s device contained an unauthorized implant, said it was working with authorities and contacting impacted users, and reported no indication its security infrastructure, systems, or services were compromised. On October 11, Ledger said the volume of impacted devices was limited and that all confirmed draining cases involved CryptoBilis-sold devices. It said CryptoBilis had stopped hardware-wallet sales, advised impacted customers to contact official support and local law enforcement, and reminded resellers to source only through authorized channels and never restock returned devices. Ledger’s October 10 update · Ledger’s October 11 update

Reported thefts and ownership claims

The October 12 CoinDesk post describes the implanted device as linked to a $93 million theft, but Ledger’s own updates do not give a loss total or say that the implant caused the drains. Earlier reporting cited on-chain investigator estimates above $86 million, and PeckShield reportedly traced about $3.89 million in theft-linked funds to Binance deposit addresses on Tron; those figures do not establish the total loss or who controlled the receiving accounts. CoinDesk’s report · The Defiant on the reported Binance deposits

CZ alleged that hackers bought CryptoBilis. The Defiant’s October 12 report says the reseller’s former founders described an operational handover in March and said their acquisition agreement delayed a public announcement until mid-October. Those accounts do not establish who acquired the business or connect its ownership change to the thefts. The Defiant’s report

What buyers should do

Ledger advises CryptoBilis customers who have not initialized their device not to begin setup. Customers who already set one up should consider moving assets to a new Ledger signer with a newly generated seed. Ledger also says to use official support channels and that it will never ask for a 24-word recovery phrase. Ledger’s customer guidance

The sources do not establish the implant’s function, its connection to the reported thefts, the confirmed loss total, or the identity of CryptoBilis’s alleged buyer.

Ledger’s latest update « · » Ledger Support « · » The Defiant report on CryptoBilis ownership claims