Attention Ledger hardware wallet users:
On October 9, Ledger’s official support account confirmed that it is investigating reports of funds being drained from users in Southeast Asia. The reports involve reseller CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines.
As a precaution, Ledger has asked the reseller to suspend sales and shipments. If you bought a device from them in the past 90 days: if you haven’t initialized it yet, don’t set it up for now; if you’ve already set it up and transferred assets to it, consider moving your assets to a new device with a newly generated recovery phrase.
Blockchain analyst Specter says they tracked hundreds of addresses drained on Bitcoin, Ethereum, and Tron, with estimated losses exceeding $86 million. This figure has not been independently verified, and Ledger has not yet announced the final cause.
At this point, it looks more like a supply-chain issue than a firmware vulnerability affecting the entire network: devices may have been swapped or tampered with at the reseller stage, with attackers gaining access to recovery phrases in advance. The official recommendation to use a new seed also points to “the seeds on this batch of devices can’t be trusted,” not “all genuine Ledger chips have been remotely hacked.”
Former Mt. Gox chief Mark Karpelès has publicly asked victims to share photos of disassembled devices to check whether extra components were implanted on the circuit boards. This is still an investigative lead, not a conclusion.
If you didn’t buy your device from CryptoBilis, this notice does not call for all users to move their assets. The biggest risk with a hardware wallet is still ending up with a tampered device. Buy only from Ledger’s official website, verify the device’s authenticity using Ledger’s official process when it arrives, generate your recovery phrase only on the device screen, and never photograph it, upload it, or share it with anyone.
Ledger will never send you a private message or call you, and will never ask for your 24 words. Anyone using this incident to “help you verify your wallet” is a scammer.
On October 9, Ledger’s official support account confirmed that it is investigating reports of funds being drained from users in Southeast Asia. The reports involve reseller CryptoBilis, an authorized reseller in Indonesia, Malaysia, and the Philippines.
As a precaution, Ledger has asked the reseller to suspend sales and shipments. If you bought a device from them in the past 90 days: if you haven’t initialized it yet, don’t set it up for now; if you’ve already set it up and transferred assets to it, consider moving your assets to a new device with a newly generated recovery phrase.
Blockchain analyst Specter says they tracked hundreds of addresses drained on Bitcoin, Ethereum, and Tron, with estimated losses exceeding $86 million. This figure has not been independently verified, and Ledger has not yet announced the final cause.
At this point, it looks more like a supply-chain issue than a firmware vulnerability affecting the entire network: devices may have been swapped or tampered with at the reseller stage, with attackers gaining access to recovery phrases in advance. The official recommendation to use a new seed also points to “the seeds on this batch of devices can’t be trusted,” not “all genuine Ledger chips have been remotely hacked.”
Former Mt. Gox chief Mark Karpelès has publicly asked victims to share photos of disassembled devices to check whether extra components were implanted on the circuit boards. This is still an investigative lead, not a conclusion.
If you didn’t buy your device from CryptoBilis, this notice does not call for all users to move their assets. The biggest risk with a hardware wallet is still ending up with a tampered device. Buy only from Ledger’s official website, verify the device’s authenticity using Ledger’s official process when it arrives, generate your recovery phrase only on the device screen, and never photograph it, upload it, or share it with anyone.
Ledger will never send you a private message or call you, and will never ask for your 24 words. Anyone using this incident to “help you verify your wallet” is a scammer.