Ledger on Oct. 12 released a 72-hour progress update on its investigation into hardware wallet tampering involving Southeast Asian reseller CryptoBilis. In a statement posted on X, the company said that, as of now, every confirmed case connected to the asset theft incident disclosed on Oct. 9 involved devices sold through CryptoBilis. Ledger added that its own systems and official direct sales channels were not affected.
Confirmed theft cases point to one reseller channel
Ledger said the number of affected devices is limited and that it is proactively reaching out to impacted users. As the investigation continues, the company said it is cooperating with relevant judicial authorities. It also said CryptoBilis has confirmed that it has fully stopped selling hardware wallets.
The update narrows the confirmed theft cases to a single reseller channel and separates that channel from Ledger’s official distribution system.
SlowMist analysis focused on malicious hardware modules
According to earlier analysis from SlowMist, the incident involved devices that had been fitted with malicious hardware modules capable of capturing and transmitting seed phrases when users entered them. The report said industry speculation had centered on the possibility that mainstream Ledger products sold through the CryptoBilis channel may have been tampered with, including the Nano X and Flex models.
Ledger’s guidance for users who bought through CryptoBilis
Ledger issued specific instructions for customers who purchased devices from CryptoBilis.
- If a device has not been initialized, do not power it on or begin the setup process.
- If a device has already been set up and used, move assets immediately to a new device protected by a fresh recovery phrase.
- The replacement device should be obtained through an official Ledger channel.
- Affected users can contact Ledger through its official support page and file a report with local judicial authorities.
Supply chain handling and resale risks under scrutiny
Ledger also warned authorized resellers and channel partners that products must be sourced only through authorized channels and that returned goods must never be sold again. The company said a returned device that is maliciously modified and then pushed back into the secondary market can become an attack vector, putting renewed attention on supply chain recirculation risk.
For users, Ledger strongly advised against buying hardware wallets from unauthorized resellers. Devices sold outside official channels may be tampered with, counterfeited, or fitted with malicious modules, the company said, and may fail to meet Ledger’s security standards.
Company warns users about phishing attempts
Ledger said incidents like this are often used by scammers to run phishing campaigns. The company said it will never call users unsolicited, contact them through private messages, or ask for a 24-word recovery phrase. If users receive suspicious calls or messages, they should stop sharing personal information at once and verify the contact through official channels.