Confirmed Oct 8-9 Ledger + CryptoBilis incident* larger than first reported.
*What Ledger says:*$JCT $RLC $KAIA
- Investigating thefts of users in *Southeast Asia* who bought devices via reseller *CryptoBilis* (spelled CryptoBilis/CryptoBillis)
- *Action:* Ordered CryptoBilis to *suspend all sales/shipments*, advised anyone who bought via them in last *90 days*: *do NOT initialize* device if not yet set up. If already set up, *make new wallet with brand new seed on clean device* + transfer funds immediately
*Scope:*
- CZ flagged: appears supply-chain — single distributor suspected of selling *counterfeit/tampered* devices
- On-chain investigator *Specter*: *hundreds of wallets* drained across BTC/ETH/Tron
- Loss estimates: security researcher *tanuki42 >$72M*, Specter *>$86M* and rising — not just a few users
- Cause still unconfirmed — possible pre-set seed cards, modified firmware, or phishing QR during setup that sends seed to attacker — investigation ongoing
This is different from Dec 2023 Ledger Connect Kit npm hack ($600k) — this is hardware distribution channel.
If you bought from CryptoBilis: check Ledger's official verification — genuine Ledger is *always blank* on first power, generates seed offline, never has pre-filled recovery sheet.
*BREAKING 🚨 Ledger investigates SE Asia thefts via reseller CryptoBilis — Suspends vendor — Losses est $72M-$86M+ across hundreds of wallets (BTC/ETH/Tron) — Possible counterfeit/tampered devices — Advisory: Don't init CryptoBilis devices from last 90 days, rotate to new seed immediately 🔒*
*What Ledger says:*$JCT $RLC $KAIA
- Investigating thefts of users in *Southeast Asia* who bought devices via reseller *CryptoBilis* (spelled CryptoBilis/CryptoBillis)
- *Action:* Ordered CryptoBilis to *suspend all sales/shipments*, advised anyone who bought via them in last *90 days*: *do NOT initialize* device if not yet set up. If already set up, *make new wallet with brand new seed on clean device* + transfer funds immediately
*Scope:*
- CZ flagged: appears supply-chain — single distributor suspected of selling *counterfeit/tampered* devices
- On-chain investigator *Specter*: *hundreds of wallets* drained across BTC/ETH/Tron
- Loss estimates: security researcher *tanuki42 >$72M*, Specter *>$86M* and rising — not just a few users
- Cause still unconfirmed — possible pre-set seed cards, modified firmware, or phishing QR during setup that sends seed to attacker — investigation ongoing
This is different from Dec 2023 Ledger Connect Kit npm hack ($600k) — this is hardware distribution channel.
If you bought from CryptoBilis: check Ledger's official verification — genuine Ledger is *always blank* on first power, generates seed offline, never has pre-filled recovery sheet.
*BREAKING 🚨 Ledger investigates SE Asia thefts via reseller CryptoBilis — Suspends vendor — Losses est $72M-$86M+ across hundreds of wallets (BTC/ETH/Tron) — Possible counterfeit/tampered devices — Advisory: Don't init CryptoBilis devices from last 90 days, rotate to new seed immediately 🔒*