The hardware wallet, which is considered to protect encrypted assets, could have been tampered with even before it reached the user's hands.
On October 12, Ledger confirmed that during a recent investigation into the theft of encrypted assets related to the Southeast Asian distributor CryptoBilis, at least one involved device was found to have unauthorized hardware implants. Ledger stated that all confirmed related cases involve devices sold through this Southeast Asian distributor, and its own systems and direct sales channels have not been found to be affected.
The incident initially gained attention around October 9. Some users who purchased hardware wallets through CryptoBilis reported that their assets were transferred. On-chain investigation agencies subsequently tracked the related addresses and estimated that the stolen amount could exceed 86 million USD; as the investigation progressed, some on-chain analyses raised the estimated financial loss to about 93.2 million USD or even higher.
It is important to note that these amounts come from third-party on-chain tracking and are not the final loss figures released by Ledger. As of now, the total number of affected devices, the full scale of victims, and the complete attack pathway have not been officially confirmed.
The issue lies not only in software but also in the device supply chain
The primary purpose of a hardware wallet is to store private keys in a dedicated device, reducing the risk of private keys being exposed to networked computers or phones. Users typically confirm transactions through the device and then send the signed results to the blockchain network.
However, this incident extends the security issue from software and networks to the device supply chain.
Ledger confirmed that at least one involved device had unauthorized hardware implants, but currently, the public information is insufficient to fully explain how the implant works, when it was installed, and whether it directly led to the theft of all related wallets. Therefore, not all losses can be simply attributed to a completely confirmed technical pathway.
The distributor involved in the incident, CryptoBilis, sells hardware wallets in Southeast Asia. During the investigation, Ledger requested the distributor to suspend sales and shipments; subsequently, CryptoBilis ceased sales of all hardware wallet inventory. Ledger also stated it is contacting affected users and cooperating with relevant institutions for investigation.
In a follow-up statement on October 11, Ledger indicated that all currently confirmed related cases involve the CryptoBilis channel and described the number of affected devices as limited. However, the company has not disclosed the complete device count and loss statistics.
On-chain fund tracking is still ongoing
The scale of the stolen assets is another reason this incident has attracted widespread attention.
The blockchain analysis firm Bitquery tracked the flow of related funds across multiple networks, estimating that approximately 315 wallets were involved in a total asset transfer of about 93.2 million USD. Different investigation firms have varying statistics, tracking points, and asset valuation methods, so there are discrepancies in the publicly available estimates.
After the funds were transferred, some assets went through exchange, cross-chain, and mixing paths, increasing the difficulty of tracking and recovering them. Investigation reports have also pointed out that some stablecoin issuers have taken freezing measures on funds suspected to be associated, including reported frozen USDC and USDT assets.
But freezing does not equate to recovery, nor does it mean that victims have received compensation. The final ownership of frozen funds, law enforcement procedures, and whether victims can receive returns still depend on subsequent investigations and relevant legal procedures.
Currently, there is also insufficient public evidence to prove that all stolen funds have been recovered or that the identity of the attackers has been determined.
What do users need to check?
Ledger recommends that users who purchased devices through CryptoBilis in the past 90 days and have not yet completed initialization should not continue setting up the device; if the device has already been used, they should consider transferring assets to a wallet established using a brand new recovery phrase, and obtain specific operational guidance through official channels.
It is necessary to emphasize that simply transferring assets to a new address controlled by the same recovery phrase does not completely mitigate the risk of the recovery phrase being leaked. Users should generate a completely new recovery phrase on a trusted device before transferring assets to the new wallet. During the process, do not input the recovery phrase into websites, chat windows, or any so-called customer service verification pages.
At the same time, users should be on guard against secondary scams that exploit the security incident. Anyone claiming to be able to recover funds or “official customer service” proactively contacting users should not be trusted outright. Recovery phrases and PIN codes should not be disclosed to anyone.
For users who purchased through other channels, Ledger currently states that its own systems and direct sales channels have not been affected by the confirmed incident, but this does not mean that all third-party sold devices can be used without inspection. Legitimate purchasing channels, unviolated or exchanged products, and correct initialization processes are all important links in the security chain of hardware wallets.
Self-custody security does not only depend on private keys
Previously, hardware wallets were often viewed as a key security tool for the self-custody of encrypted assets. But this incident reminds the market: security depends not only on whether private keys are offline but also on whether the device is trustworthy during production, transportation, distribution, and initialization.
If the device was maliciously altered before delivery, even if users operate according to conventional processes, they may still face additional risks. For wallet manufacturers, in addition to clarifying the attack pathway, it is also necessary to strengthen distributor management, device integrity verification, and user risk alerts.
This incident is still under investigation, and the most concerning aspect is not the unverified loss figures but whether attackers have circumvented users' trust in hardware wallets through supply chain links. As on-chain fund tracking and device forensics progress, the official disclosure of the attack mechanisms, the scope of impact, and the progress of fund freezing will determine how the incident is characterized moving forward.
If you are also paying attention to the Crypto market and want to participate in trading or asset allocation, you can register through the following exclusive channels and enjoy discounts:
Binance: Register through the exclusive link, fill in the invitation code aicoin668, and you can enjoy a 10% rebate.
Registration link: https://jump.do/zh-Hans/xlink-proxy?id=3
Benefits group: https://www.aicoin.com/link/chat?cid=gmLgwvKD1
OKX: Register through the AiCoin exclusive link to enjoy a permanent 20% rebate.
Registration link: https://jump.do/zh-Hans/xlink-proxy?id=2
Benefits group: https://aicoin.com/link/chat?cid=l61eM4owQ
Bitget: Register through the AiCoin exclusive channel to enjoy a 10% trading fee rebate.
Registration link: https://jump.do/zh-Hans/xlink-proxy?id=6
Benefits group: https://aicoin.com/link/chat?cid=N63yYYKQ
You are also welcome to join related AiCoin communities to get more information on new coins from exchanges and earning opportunities:
Official Telegram community: https://t.me/aicoin_support
AiCoin Chinese Twitter: https://x.com/AiCoinzh
The content of this article only represents the author's personal viewpoint and does not represent the position of this platform. The opinions, conclusions, and suggestions in this article are for investors' reference only and do not constitute any investment advice related to this platform. The market has risks, and investment needs caution.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
