In a statement on October 11, hardware wallet maker Ledger narrowed the scope: every verified theft case involved devices sold by Southeast Asian authorized reseller CryptoBilis. The company found no signs of a breach in its own systems or direct-sales products.
The timeline is more telling. On October 9, Ledger asked the reseller to suspend all shipments; on the 10th, it confirmed that at least one device contained an unauthorized hardware implant; and on the 11th, it traced the issue to a single sales channel. Former Mt. Gox head Karpeles took apart a Ledger Nano X sourced from Malaysia that appeared factory-sealed. Beneath the screen padding was an extra circuit board with cellular components, capable of capturing the recovery phrase displayed on the screen during setup. The device looked normal, and its firmware check passed as usual.
On-chain estimates put losses at between $70 million and $93 million. Ledger has not confirmed any single figure. Some funds have been frozen, and both $BTC and $ETH are among the affected assets.
The advice is straightforward: if you bought a device through that channel in the past three months and haven’t activated it, don’t use it. If you have already used it, transfer your assets to a new device and generate a new recovery phrase. Ledger reiterates that it will never ask for your 24 words.
Every extra middleman in the supply chain is another unseen hand.
The timeline is more telling. On October 9, Ledger asked the reseller to suspend all shipments; on the 10th, it confirmed that at least one device contained an unauthorized hardware implant; and on the 11th, it traced the issue to a single sales channel. Former Mt. Gox head Karpeles took apart a Ledger Nano X sourced from Malaysia that appeared factory-sealed. Beneath the screen padding was an extra circuit board with cellular components, capable of capturing the recovery phrase displayed on the screen during setup. The device looked normal, and its firmware check passed as usual.
On-chain estimates put losses at between $70 million and $93 million. Ledger has not confirmed any single figure. Some funds have been frozen, and both $BTC and $ETH are among the affected assets.
The advice is straightforward: if you bought a device through that channel in the past three months and haven’t activated it, don’t use it. If you have already used it, transfer your assets to a new device and generate a new recovery phrase. Ledger reiterates that it will never ask for your 24 words.
Every extra middleman in the supply chain is another unseen hand.