Ledger Buyers Reported $86 Million Lost Through an Authorized Reseller. The Genuine Check Proves the Chip, Not the Box

What Happened

Ledger's support account posted on Friday, October 9, that the company is investigating reports of losses among users in Southeast Asia who bought devices from CryptoBilis, a reseller that Ledger's own directory lists as authorized for Indonesia, Malaysia, and the Philippines. Ledger said it had asked the reseller to pause all sales and shipments of Ledger devices, recommended that anyone who bought from CryptoBilis in the last 90 days 'not initiate set up if you have not done so yet,' and told anyone who already had to consider moving assets to a new Ledger device with a newly generated seed phrase.

It added that 'no reports were made of products purchased directly from Ledger, and Ledger's infrastructure, systems and services were not compromised.' CryptoBilis closed its physical stores, paused every brand it carries in the 3 countries, and promised a statement within 3 business days, per BitPinas.

The loss numbers come from on-chain trackers, not from Ledger. A researcher posting as tanuki42 flagged more than $72 million moving to a cluster of suspected theft addresses; Specter traced more than $86 million across Bitcoin, Ethereum, and Tron, first described 'hundreds' of drained wallets, then said the count was not established; MistTrack put the total near $90 million; Bitquery reconstructed $92.

9 million from 311 wallets on 5 networks. The estimates overlap imperfectly; the range as of this writing is $72 million to $93 million. Tether froze USDT at addresses tied to the case, roughly $10 million by Bitquery's count, and the thief answered by swapping USDT into USDD, a Tron stablecoin Tether has no switch for, in amounts reports put at $2 million to $14.

9 million.

The Genuine Check answered the only question it was built to answer: the chip is real. The question these buyers needed answered was who had the box before they did, and no signature covers that.

The Check Proves the Chip, Not the Box

Ledger's defense against a tampered device is the Genuine Check. During setup, Ledger's companion app sends a random challenge to the device; the Secure Element signs it with a private key injected at the factory, and Ledger's servers verify the signature. A pass means the chip inside is one Ledger made and is running Ledger's firmware.

Ledger puts no tamper seals on its boxes; it says holographic seals 'can give you a false sense of security' since they are cheap to copy, and its buying guide concedes the check does not establish where a device has been. The guarantee is cryptographic, and it stops at the edge of the chip.

That edge is where the claim about these devices sits. Mark Karpelès, the former chief executive of Mt. Gox, said on October 9 that a Nano X he obtained from Malaysia, in packaging that looked untouched, carried a second circuit board where the padding behind the screen should be: a microcontroller wired to the Serial Peripheral Interface (SPI) bus that feeds the display, a Long-Term Evolution (LTE) cellular module, an antenna, and an embedded SIM.

The device passed the Genuine Check, he said, because the Secure Element was authentic. SlowMist's chief information security officer, who posts as 23pds, called the attack path a hypothesis: the Secure Element never exports the private key, but it draws the 24 recovery words on the screen, and a module on the display bus can read what the chip tells the screen to show and send it out over cellular.

No independent teardown had been published as of this writing, and Karpelès has not said his device came from CryptoBilis. Ledger's own August 2019 security bulletin conceded that a USB-cable implant could recover the recovery words from the display's power draw; the display has been the known edge for 7 years.

The counter-reading deserves equal weight. Taylor Monahan, MetaMask's principal security researcher, said there is 'absolutely not' a zero-day in Ledger and that the accounts amplifying drain reports were creating panic the evidence did not support. Crypto Briefing counted 3 explanations in circulation: a hardware or firmware flaw, compromised seed phrases, and phishing.

A pre-seeded device, the 2018 scam of a second-hand Nano sold with the seller's recovery seed already in place, needs no implant at all. Each of these fits the one fact Ledger has committed to: the reports cluster on a single reseller's customers.

'Authorized' Is a Commercial Status, Not a Chain of Custody

Ledger's buying guide says the company 'controls its entire distribution pipeline from factory to shelf' and publishes a list of authorized resellers. CryptoBilis was on the list. What the list did not show is who owned the shelf. Per BitPinas and corporate records reported by KuCoin News, the business was acquired in March 2026 under a non-disclosure agreement, and the share transfer completed on August 3, with an individual named Jiaming, registered in Heilongjiang Province, China, holding 100%.

No evidence ties the sale to the thefts. The point is narrower: an authorized-reseller badge is a contract between 2 companies, and it survived a change in control that the customers relying on it never saw.

The pattern has a history, and the documented prior versions were smaller. In June 2021, after Ledger's customer database leaked, fraudsters mailed breach victims fake Nano X units with a USB flash implant and a letter purporting to come from Ledger's chief executive, and Ledger confirmed the devices were counterfeit.

In January 2025, a buyer who ordered a Nano X from a Lazada storefront calling itself 'Ledger Thailand' passed the Genuine Check, set up a seed, and lost $214,000 within about 6 weeks, per Merkle Science. Changpeng Zhao's read on Friday, that this 'seems to be localized to a supply chain attack with one vendor' and a small number of people bought tampered units, is the most likely shape of it.

A small number of people, on the current estimates, lost $72 million to $93 million.

If Your Device Came Through a Reseller

Step 1: if you bought any hardware wallet through CryptoBilis since July, do not set it up, and if it is set up, treat the seed as burned. Buy a replacement from the manufacturer's own store, generate a new seed on the new device, move the funds, and keep the old device, photographed.

Step 2: for a device bought through any reseller in the last 90 days, a Genuine Check pass is necessary and not sufficient. Karpelès has asked buyers to photograph the board; the implant he describes leaves an antenna wire and a missing screen pad. Step 3: quarantine. Set up the device, deposit a trivial amount, and wait 2 weeks before moving real funds, because a compromised batch shows up in other victims' losses before it shows up in yours.

Step 4: act on nothing that arrives in your inbox about this incident. The people rushing to move funds are this week's phishing market.

What This Means for You

A hardware wallet exists so that your private keys never touch a general-purpose computer, and as far as anyone has shown, that property held. If the implant account is right, no key left a Secure Element; the words were read off the bus on their way to the screen, which is to say the chip did its job and the enclosure around it did the attacker's.

If the phishing or pre-seeding accounts are right, the device was never the vector. Either way, the control that failed was provenance, and provenance is the one control a buyer sets. Buy from the manufacturer. A reseller discount is a discount on the one thing the Genuine Check cannot verify.

Then stop depending on one device. A 2-of-3 multi-sig with keys on devices from 2 different vendors, bought through 2 different channels, leaves a tampered unit holding 1 key of the 2 it would need; it signs nothing alone, and the cost is a second device and an afternoon. A BIP-39 passphrase is not a substitute: on a Nano it is entered and shown on the same screen an implant would read.

The freeze is the last lesson: Tether's switch caught about $10 million, and within hours the thief was moving millions more into a token with no switch. Nobody can freeze your coins, and nobody can freeze them back. Provenance is the premium on that trade, and the only line item you control.

What to Watch

The first checkpoint is a teardown of a sealed, CryptoBilis-sourced unit by someone other than Karpelès; SlowMist, Ledger's Donjon team, and the Security Alliance are the candidates, and Karpelès has asked the reseller to open unsold inventory. Ledger said it would post updates, and CryptoBilis promised a statement within 3 business days; whether either names a mechanism or a shipment range will decide how many of Bitquery's 311 wallets belong to this incident at all.

Watch the Bitquery and MistTrack totals for convergence, and whether Trezor, Coinkite, or BitBox say anything about their own Southeast Asian channels. If Malaysian or Philippine authorities open a case against the reseller, the ownership chain becomes evidence rather than coincidence.

And if Ledger extends the Genuine Check to attest to anything beyond the Secure Element, it will have conceded the point.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.