A newly purchased hardware wallet may already be unsafe before you even unbox it.
Ledger began investigating reports of Southeast Asian users’ assets being stolen at 21:32 (UTC+8) / 13:32 UTC on 10/9. The next day, it confirmed that one victim’s device contained an “unauthorized hardware implant.” All confirmed cases involved the same reseller, CryptoBilis (media reports identify it as Ledger’s authorized reseller in Indonesia, Malaysia, and the Philippines). Ledger says its own systems and direct sales through its website were unaffected. CryptoBilis has stopped selling all hardware wallets.
Ledger hasn’t disclosed the total losses. Media-cited on-chain estimates range from about $72 million to $93 million. I can’t independently verify those figures, so consider them unconfirmed for now.
Why this kind of incident is especially hard to guard against (my inference): the recovery phrase is generated on the wallet. If the hardware was tampered with before you received it, the phrase could be exposed as soon as it’s generated. Changing your PIN or switching phones won’t help. That’s why the official advice isn’t to update the firmware, but to switch to a trusted device and generate a new recovery phrase.
How to tell whether you might be affected:
1. If you bought from CryptoBilis in the last 90 days: don’t set it up if you haven’t turned it on yet. If you’re already using it, the official advice is to generate a new recovery phrase on a new device obtained from Ledger, then transfer your assets to it.
2. If you bought through another channel: this incident involved an “authorized reseller,” so authorization doesn’t guarantee safety. Ledger has also reminded resellers not to put returned devices back on sale. Don’t use secondhand or unsealed devices, or any card in the box with a “prewritten recovery phrase.”
3. Watch out for a second wave of scams: Ledger says it will never call or message you, or ask for your 24-word recovery phrase. If anyone claiming to be customer support offers to “check your device” in the coming days, treat it as a scam.
Replacing a device and transferring funds both come at a cost. But if your device is confirmed to have come from this reseller, you should treat your recovery phrase as already compromised.
Did you buy your hardware wallet from the official website, an authorized physical store, an e-commerce platform, or secondhand?
Sources: Ledger’s official X posts (updates on 10/9, 10/10, and 10/11), Cointelegraph, TokenPost | Not investment advice
Ledger began investigating reports of Southeast Asian users’ assets being stolen at 21:32 (UTC+8) / 13:32 UTC on 10/9. The next day, it confirmed that one victim’s device contained an “unauthorized hardware implant.” All confirmed cases involved the same reseller, CryptoBilis (media reports identify it as Ledger’s authorized reseller in Indonesia, Malaysia, and the Philippines). Ledger says its own systems and direct sales through its website were unaffected. CryptoBilis has stopped selling all hardware wallets.
Ledger hasn’t disclosed the total losses. Media-cited on-chain estimates range from about $72 million to $93 million. I can’t independently verify those figures, so consider them unconfirmed for now.
Why this kind of incident is especially hard to guard against (my inference): the recovery phrase is generated on the wallet. If the hardware was tampered with before you received it, the phrase could be exposed as soon as it’s generated. Changing your PIN or switching phones won’t help. That’s why the official advice isn’t to update the firmware, but to switch to a trusted device and generate a new recovery phrase.
How to tell whether you might be affected:
1. If you bought from CryptoBilis in the last 90 days: don’t set it up if you haven’t turned it on yet. If you’re already using it, the official advice is to generate a new recovery phrase on a new device obtained from Ledger, then transfer your assets to it.
2. If you bought through another channel: this incident involved an “authorized reseller,” so authorization doesn’t guarantee safety. Ledger has also reminded resellers not to put returned devices back on sale. Don’t use secondhand or unsealed devices, or any card in the box with a “prewritten recovery phrase.”
3. Watch out for a second wave of scams: Ledger says it will never call or message you, or ask for your 24-word recovery phrase. If anyone claiming to be customer support offers to “check your device” in the coming days, treat it as a scam.
Replacing a device and transferring funds both come at a cost. But if your device is confirmed to have come from this reseller, you should treat your recovery phrase as already compromised.
Did you buy your hardware wallet from the official website, an authorized physical store, an e-commerce platform, or secondhand?
Sources: Ledger’s official X posts (updates on 10/9, 10/10, and 10/11), Cointelegraph, TokenPost | Not investment advice