Verify a decision

{"actor":"system:backfill","investigation_id":"14817ad5-ba1b-4bd6-acb1-90998aeab19d","kind":"publish","page_slug":"ledger-cryptobilis-supply-chain-attack","published_at":"2026-10-12T04:05:37.281Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Ledger CryptoBilis Supply Chain Attack","sections":[{"content":"On October 9, 2026, Ledger said via its support account on X that it was investigating reports of fund losses among users in Southeast Asia who purchased hardware wallets through CryptoBilis, a reseller that Ledger listed as an official partner for Indonesia, Malaysia, and the Philippines. Ledger asked CryptoBilis to pause all sales and shipments of its devices while the review was underway. Ledger advised customers who had bought a device from CryptoBilis in the past 90 days not to initialize it if they had not already done so, and advised those who had already set up a device to consider moving their assets to a new Ledger signer generated with a new seed phrase. Ledger stated it had received no reports involving devices purchased directly from the company and said it had no indication that its own security infrastructure, systems, or services had been compromised, describing the incident as apparently isolated to the reseller and the affected market.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses - The Block","type":"news_article","url":"https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163"},{"credibility":2,"name":"Ledger investigates fund losses linked to Southeast Asian reseller, warns users - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users"},{"credibility":2,"name":"Ledger asks CryptoBilis to halt sales amid reports of lost funds - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/ledger-asks-cryptobilis-to-halt-sales-amid-reports-of-lost-funds"}]},{"content":"No official loss total has been confirmed by Ledger. Independent on-chain researchers produced conflicting, unverified estimates. Pseudonymous analyst 'tanuki42' identified addresses linked to more than $72 million in suspected theft and urged affected users to contact SEAL 911 (Security Alliance's incident-response team). Separately, a researcher using the handle 'Specter' traced inflows to suspected theft addresses across Bitcoin, Ethereum, and Tron and put the figure above $86 million, citing Arkham Intelligence data showing roughly $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT. Specter initially said the funds originated from hundreds of victim wallets, then said the actual number of affected wallets was not yet known. Decrypt reported Specter traced theft addresses flagged by users on X and Reddit. It remains unclear whether the two main estimates (from tanuki42 and Specter) refer to the same set of transactions or represent overlapping or distinct totals. Separate on-chain monitoring service Onchain Lens reported roughly $270,000 in USDT and TRX moved from linked wallets to a Binance hot wallet. None of these figures have been independently verified or corroborated by Ledger.","heading":"Loss Estimates and On-Chain Tracing","severity":"high","sources":[{"credibility":2,"name":"Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses - The Block","type":"news_article","url":"https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163"},{"credibility":3,"name":"Ledger CryptoBilis reseller: $86M drained funds - TFTC","type":"news_article","url":"https://www.tftc.io/ledger-cryptobilis-reseller-86m-drained-funds"},{"credibility":2,"name":"Decrypt coverage of Ledger/CryptoBilis incident","type":"news_article","url":"https://decrypt.co/380582"},{"credibility":2,"name":"Ledger investigates fund losses linked to Southeast Asian reseller, warns users - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users"}]},{"content":"Separate from the initial reseller advisory, reporting indicated Ledger issued a further update stating that at least one affected device examined in the investigation contained an unauthorized hardware implant. According to this reporting, the implant allegedly captured seed phrase characters as they were displayed and transmitted them over a cellular network, while leaving the device's primary security chip (Secure Element) untouched, allowing the device to still pass Ledger's 'Genuine Check' authenticity verification. Separately, Mark Karpelès, the former CEO of Mt. Gox, posted photographs of a Ledger device he said he had examined, which he said contained LTE components, an antenna, an eSIM, and a microcontroller concealed in the padding behind the screen, wired to the device's SPI display bus. Karpelès asked other affected users to photograph their device circuit boards so he could check for similar tampering. Crypto Briefing and other outlets noted that the available source material did not establish that the specific device Karpelès examined was purchased through CryptoBilis, so the implant claim and the CryptoBilis reseller investigation, while reported on the same day and region, are not confirmed to be the same incident. Reports of hardware implants found inside secondhand or resold Ledger devices, including a documented case in Thailand, have surfaced at earlier points in 2026 and in prior years, independent of this specific incident. Given the reliance on researcher claims, unverified photographs, and reporting that itself flags the implant-to-reseller link as unconfirmed, this section should be treated as a low-to-medium confidence allegation pending Ledger's own technical confirmation.","heading":"Alleged Hardware Implant","severity":"critical","sources":[{"credibility":3,"name":"Ledger CryptoBilis reseller: $86M drained funds - TFTC","type":"news_article","url":"https://www.tftc.io/ledger-cryptobilis-reseller-86m-drained-funds"},{"credibility":2,"name":"Ledger users warned of potential implant in Malaysian devices - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/ledger-malaysia-hidden-implant-cryptobilis/"}]},{"content":"Reporting is mixed on CryptoBilis's precise status. Multiple outlets, including TFTC and Cointelegraph, described CryptoBilis as an officially authorized Ledger reseller listed on Ledger's own partner pages for Indonesia, Malaysia, and the Philippines, operating out of Kuala Lumpur, and stated it was not a gray-market operation; Ledger's vetting of the business relationship does not necessarily mean Ledger audited CryptoBilis's logistics or supply chain. Other, lower-reliability reports characterized CryptoBilis as an unauthorized reseller or cited victim reports from the Philippines, Vietnam, and Thailand, which conflicts with the authorized-partner characterization; these discrepancies have not been resolved in available reporting. One report claimed corporate records show the company is wholly owned by a Chinese national, but stated there was no conclusive evidence linking that ownership to the alleged device compromise; this claim is treated here as low-confidence, Tier 3 sourcing. As of the most recent reporting available, CryptoBilis had not issued a public statement and did not respond to press inquiries.","heading":"CryptoBilis Reseller Status and Background","severity":"medium","sources":[{"credibility":3,"name":"Ledger CryptoBilis reseller: $86M drained funds - TFTC","type":"news_article","url":"https://www.tftc.io/ledger-cryptobilis-reseller-86m-drained-funds"},{"credibility":2,"name":"Ledger investigates fund losses linked to Southeast Asian reseller, warns users - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users"}]},{"content":"Binance co-founder Changpeng 'CZ' Zhao publicly said the available information suggested a supply-chain attack involving a single vendor, and that a small number of users may have purchased fake or tampered Ledger devices. He said he expected BNB ecosystem participants and the broader industry to help trace and recover the funds, and remarked that 'self-custody comes with extra responsibilities.' Mark Karpelès said the reports could be connected to an issue he was already separately investigating, and asked affected users to contact him directly. Security Alliance (SEAL) urged affected users to contact its incident-response team (SEAL 911) but did not provide its own loss estimate or confirm a cause.","heading":"Industry Reactions","severity":"medium","sources":[{"credibility":2,"name":"Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses - The Block","type":"news_article","url":"https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163"},{"credibility":2,"name":"Ledger investigates fund losses linked to Southeast Asian reseller, warns users - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users"}]},{"content":"The CryptoBilis incident followed several other Ledger-related security events earlier in 2026. In January 2026, unauthorized access to a third-party payment and logistics partner (Global-e) exposed some Ledger.com order information, including names, addresses, and contact details, though Ledger's own systems and private keys were reportedly unaffected. In April 2026, a counterfeit Ledger Live application appeared on Apple's App Store for about a week and tricked users into entering recovery phrases, with more than 50 reported victims losing a combined estimated $9.5 million across multiple blockchains before Apple removed the app; Ledger reiterated that it would never ask users for their 24-word recovery phrase. In August 2026, Ledger disclosed Ethereum application signature vulnerabilities, including a command-interleaving issue and a clear-signing bypass, that could theoretically desynchronize displayed transaction data from what a device actually signed; Ledger said exploitation required a malicious host application and that it found no evidence of real-world exploitation before issuing a fix. These incidents are separate from the October 2026 CryptoBilis matter but form part of the pattern of supply-chain, software-distribution, and firmware-level risks Ledger has faced in 2026.","heading":"Broader 2026 Context of Ledger Security Incidents","severity":"medium","sources":[{"credibility":2,"name":"ChainCatcher coverage of Ledger CryptoBilis and prior 2026 incidents","type":"news_article","url":"https://www.chaincatcher.com/en/article/2295265"}]}],"sources_used":[{"credibility":2,"name":"Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses - The Block","type":"news_article","url":"https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163"},{"credibility":2,"name":"Ledger investigates fund losses linked to Southeast Asian reseller, warns users - Cointelegraph","type":"news_article","url":"https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users"},{"credibility":2,"name":"Ledger asks CryptoBilis to halt sales amid reports of lost funds - The Defiant","type":"news_article","url":"https://thedefiant.io/news/hacks/ledger-asks-cryptobilis-to-halt-sales-amid-reports-of-lost-funds"},{"credibility":3,"name":"Ledger CryptoBilis reseller: $86M drained funds - TFTC","type":"news_article","url":"https://www.tftc.io/ledger-cryptobilis-reseller-86m-drained-funds"},{"credibility":2,"name":"Decrypt coverage of Ledger/CryptoBilis incident","type":"news_article","url":"https://decrypt.co/380582"},{"credibility":2,"name":"Ledger users warned of potential implant in Malaysian devices - Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/ledger-malaysia-hidden-implant-cryptobilis/"},{"credibility":2,"name":"ChainCatcher coverage of Ledger CryptoBilis and prior 2026 incidents","type":"news_article","url":"https://www.chaincatcher.com/en/article/2295265"},{"credibility":3,"name":"Ledger reports $90M security incident linked to CryptoBilis distributor - KuCoin News Flash","type":"news_article","url":"https://www.kucoin.com/news/flash/ledger-reports-90m-security-incident-linked-to-cryptobilis-distributor"},{"credibility":3,"name":"CZ warns of risk of supply chain attack on Ledger hardware wallets - KuCoin News Flash","type":"news_article","url":"https://www.kucoin.com/news/flash/cz-warns-of-ledger-hardware-wallet-supply-chain-attack-risk"},{"credibility":2,"name":"Ledger's crypto wallets reportedly backdoored, $71 million in crypto already moved - Gizmodo","type":"news_article","url":"https://gizmodo.com/ledgers-crypto-wallets-reportedly-backdoored-71-million-in-crypto-already-moved-2000824372"}],"summary":"In October 2026, Ledger opened an investigation into reports of large-scale wallet drains affecting customers in Southeast Asia who bought hardware wallets through CryptoBilis, a reseller authorized in Indonesia, Malaysia, and the Philippines. On-chain researchers estimated losses ranging from roughly $72 million to over $86 million, and separate reporting cited an alleged hidden hardware implant capable of exfiltrating seed phrase data over a cellular network, though Ledger had not confirmed the cause, the total loss figure, or the number of victims as of this writing. This page concerns this specific incident; it does not restate the overall trust assessment of Ledger's existing profile.","timeline":[{"date":"2026-01","event":"A third-party payment and logistics partner (Global-e) suffers unauthorized access exposing some Ledger.com customer order data; Ledger's own systems and private keys reportedly unaffected.","source":"ChainCatcher","source_url":"https://www.chaincatcher.com/en/article/2295265"},{"date":"2026-04","event":"A counterfeit Ledger Live app appears on Apple's App Store for about a week, leading to over 50 reported victims and an estimated $9.5 million in losses before removal.","source":"ChainCatcher","source_url":"https://www.chaincatcher.com/en/article/2295265"},{"date":"2026-08","event":"Ledger discloses Ethereum application signature vulnerabilities, including a command-interleaving issue and clear-signing bypass; no evidence of real-world exploitation found.","source":"ChainCatcher","source_url":"https://www.chaincatcher.com/en/article/2295265"},{"date":"2026-10-09","date_evidence":"Published: October 9, 2026, 10:52 AM EDT","event":"Ledger posts a support advisory on X saying it is investigating reports of fund losses among Southeast Asian customers who bought devices from reseller CryptoBilis, asks CryptoBilis to halt sales and shipments, and advises recent buyers not to initialize devices.","source":"The Block","source_url":"https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163"},{"date":"2026-10","date_original":"2026-10-09","event":"On-chain researcher 'tanuki42' reports more than $72 million moved to suspected theft addresses; researcher 'Specter' separately estimates losses above $86 million across Bitcoin, Ethereum, and Tron, citing Arkham Intelligence data. Figures remain unconfirmed by Ledger.","source":"The Block / Decrypt","source_url":"https://decrypt.co/380582"},{"date":"2026-10","date_original":"2026-10-09","event":"Mark Karpelès, former Mt. Gox CEO, posts photos of a Ledger device he says contains a hidden hardware implant (LTE components, antenna, eSIM, microcontroller) concealed behind the screen; CZ publicly suggests a supply-chain attack involving a single vendor.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/ledger-malaysia-hidden-implant-cryptobilis/"},{"date":"2026-10","event":"Reporting indicates a further Ledger update describing an unauthorized hardware implant found in at least one examined device that allegedly exfiltrated seed phrase data via cellular network while evading Ledger's Genuine Check.","source":"TFTC","source_url":"https://www.tftc.io/ledger-cryptobilis-reseller-86m-drained-funds"}]},"v":1}