Ledger’s supply-chain security incident linked to third-party sales channel CryptoBilis continues to expand, as more abnormal device cases and potentially risky distributors come into view. Ledger said its own systems and direct-sales channels were not affected, but the episode has pushed hardware-wallet supply-chain security to the center of the market’s attention.
More than the theft cases themselves, the issue is now testing user trust. Devices long treated as a key line of defense for private keys are being scrutinized for whether the hardware itself can still be trusted.
More suspicious samples and reseller concerns emerge
On Oct. 11, crypto analyst Darkfost said that after the CryptoBilis-related security incident came to light, community discussions pointed to other distributors that might also carry risk, including some merchants on Lazada. He said Ledger has not been able to determine whether CryptoBilis was the only sales channel involved. Given regional links among some distributors, Darkfost said the possibility that multiple channels were compromised at the same time could not be fully ruled out.
Based on information disclosed by the community, he compiled a list of “potentially risky Ledger resellers” covering more than 20 distributors. The risks have not been confirmed, but he warned users who bought Ledger hardware wallets through those channels in the past six months to carefully assess device security and consider moving assets to a new secure device.
At the same time, suspected related cases have surfaced across Asia, South America and Europe, adding to concern over how far the attack may have spread. Security researcher Johannes disclosed that a user who bought a hardware wallet from a Ledger official reseller in Europe discovered unauthorized hardware implanted inside the device several weeks later. Johannes said the implant appeared to use an earlier design, while newer versions of the implanted component may be hidden behind the screen, making detection harder.
The range of affected device models has also widened. In addition to the Ledger Nano X, the flagship Ledger Stax has also been cited in a suspected tampering case. X user @Wentrre said that after taking apart a Ledger Stax, he found an extra small board on the motherboard, a cellular communication module labeled Nordic nRF9151, and what appeared to be antenna wiring inside the device. Because those structures raised security questions, the user later asked Ledger whether the device was abnormal.
Responding to that case, SlowMist founder Yu Xian posted teardown comparison images, saying the abnormal sample showed an extra communication module and suspected antenna wiring, structures not visible in reference images of an official genuine Stax. Yu Xian said the people involved in the Ledger backdoor implantation case were “hardware hacking” experts.
As more cases surfaced, concern around hardware-wallet security kept building. Some users said they no longer dared to power on newly purchased Ledger devices and had set them aside for the time being. Others chose to open devices themselves, post internal photos publicly, and ask the community and security researchers to help verify what they found. Teardown guides also began circulating on social platforms.
Ledger releases a 72-hour update
Early on Oct. 12, Ledger published a 72-hour update on the CryptoBilis incident, outlining the latest findings and follow-up actions in what the report described as a near-$100 million black swan event.
Ledger said it is working with law-enforcement agencies on the investigation, that the number of confirmed affected devices remains limited, and that it has proactively contacted relevant users. The company advised affected users to contact Ledger support through official channels and file reports with local law enforcement.
Ledger also said that, as of the notice, all confirmed theft cases involved devices sold through CryptoBilis, and that its own systems and direct-sales channels had not been affected. CryptoBilis has confirmed that it has stopped selling all hardware wallets.
For users who may have been affected, Ledger said they should not initialize related devices that have not yet been used. If a device has already been set up, users should move assets to a new device obtained through official channels and generate a brand-new seed phrase on that replacement device.
As part of its response, Ledger said it will continue reviewing and strengthening distribution controls and anti-tampering procedures. It also said distributors must source products only through authorized channels and must not relist returned goods for sale. Ledger urged users to avoid buying hardware wallets from unauthorized channels to reduce the risk of receiving tampered or counterfeit devices.
OneKey, SafePal, Trezor, Tangem and imKey issue statements
CryptoBilis did not sell Ledger products alone. As the incident spread, several other hardware-wallet brands also responded.
OneKey founder Yishi said the company had not received reports of affected OneKey devices, but had terminated CryptoBilis as an authorized reseller and would provide free replacements for users who bought related products through that channel. OneKey also said it was suspending the addition of new resellers and conducting a full review of existing distribution channels. Resellers whose operating entity or ultimate beneficial owner cannot be verified will lose authorization, and the company plans to publish a complete list of authorized distributors after the review is complete.
SafePal said it had noticed reports of stolen assets involving Ledger devices purchased through CryptoBilis and was closely following developments. Addressing concerns about supply-chain security, SafePal described several safeguards in its own hardware wallets, including verification of authenticity and usage status during first-time setup, warnings for devices that have already been activated along with the date of first activation, and tamper-evident seals to show whether packaging has been opened. SafePal said users should stop using a device immediately and contact official support if any of those checks shows an abnormal result.
Trezor said it is actively investigating the CryptoBilis reseller security incident and that there are currently no signs its devices were affected. As a precaution, Trezor has removed CryptoBilis from its authorized reseller list and stopped sales through that channel. Trezor also warned users not to disassemble devices on their own to avoid damage. For the battery-equipped Safe 7, it said users should be aware of added safety risks tied to the hardware.
Tangem responded from the standpoint of product design. The company said its card-based hardware wallet uses an integrated sealed design that combines a secure chip with an NFC antenna, with private keys generated and transaction signatures completed inside the chip so the keys never leave it. It added that firmware is written at the factory and cannot be modified afterward. Tangem said users can verify authenticity and first-activation status through the Tangem App. The company said that whether a device is bought from its official store, a reseller or another channel, if the app verifies the device as genuine, private keys remain under the user’s control, including devices purchased through CryptoBilis.
imKey also issued a statement saying it has not received feedback so far regarding abnormal imKey devices or asset losses related to the incident. As a precaution, imKey said it will further review its authorized distribution channels and take necessary measures based on the findings to reduce channel risk.
Trust pressure now extends beyond a single brand
The responses from manufacturers show a common approach: tightening channel management, explaining built-in security measures and warning users about risks. Those steps may ease some anxiety, but they may not quickly repair trust that has already been damaged.
For hardware-wallet makers, getting past this episode will require more than public statements. The report said the industry still needs transparent and verifiable investigation results, clear risk screening and remediation plans, and supply-chain control and anti-tampering measures that can withstand scrutiny.