Bought a Ledger From CryptoBilis? Here’s What Ledger Says to Do

Signal Spotlight · Hardware wallets, resellers and custody risk

What happened

On 9 October, Ledger said it is investigating reports of fund losses among users in Southeast Asia who bought its products from CryptoBilis. Ledger said it asked the reseller to pause all sales and shipments, and that its own "infrastructure, systems and services were not compromised." Ledger told Cointelegraph the incident appears isolated to the reseller and the affected market, and that it has no reports involving devices bought directly from Ledger. It has not said how many customers are affected, how much was lost, or what caused it.

Ledger's advice is specific. Anyone who bought from CryptoBilis in the last 90 days should not set up the device. Anyone who already did should consider moving assets to a new Ledger signer with a newly generated recovery phrase. Ledger said it will keep customers updated as the investigation progresses.

What is alleged, and what is not

The losses. Researcher tanuki42 identified eight wallet addresses linked to more than $72 million in suspected thefts. Investigator Specter estimated losses above $86 million across Bitcoin, Ethereum and Tron. According to The Block, he first said the funds came from hundreds of victim wallets and then said the number of affected wallets is not yet known. These are researcher estimates. Ledger has not confirmed them, and The Block notes it is unclear whether the two figures cover the same transactions or whether every theft is tied to the reseller.

The link to CryptoBilis. tanuki42 told Cointelegraph the link is not certain, but that they were not aware of a victim report that does not involve this reseller.

The cause. It has not been established. No tampering has been confirmed. One security lab, Tibane Labs, examined two Ledger Nano X units with suspected hardware implants that it says could read recovery words and send them out, but the units came from other sources and the study does not link them to CryptoBilis, according to Forklog. Treat that as context, not an explanation.

Why it matters

The signal is that where a hardware wallet comes from is part of the security model. Whatever the cause turns out to be, Ledger's own advice treats devices bought through one reseller as a risk, even though it says its systems were not compromised. For anyone holding funds on a device, the secure element only helps if the device and its setup are what they should be.

The picture is also still partial. The loss figures are estimates and the cause is unknown. Calling this a confirmed supply-chain compromise would go further than Ledger or the reporting does, so we are not doing that.

For Philippine readers, CryptoBilis is listed as an authorised reseller in the Philippines, so the affected market includes it. Ledger has not said how many of the affected users are in the Philippines. Our reading is that treasury and custody teams should check where their devices came from, though Ledger's own advice is scoped to CryptoBilis purchases in the last 90 days.