Wallets bought through Southeast Asian Ledger reseller CryptoBilis were drained of an estimated $93.2 million across 315 addresses on six blockchains, according to onchain data firm Bitquery. Ledger has confirmed that at least one affected device contained an unauthorized hardware implant.
The drains took place on Oct. 9 and 10. CryptoBilis was listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger asked it to halt all sales and shipments, and the reseller has since suspended sales of its entire hardware-wallet inventory pending the investigation. Ledger has not confirmed the dollar figure, how many devices were tampered with, or whether the implant caused every theft. The company says its own infrastructure, systems and services were not compromised.
The clearest technical picture so far comes from former Mt. Gox CEO Mark Karpelès. He said a Ledger Nano X he received from Malaysia in intact shrink-wrap contained a module with LTE components, an antenna, an eSIM and a microcontroller wired to the screen’s data bus. The implant never touches the secure element that generates the keys. Instead, it reads the recovery phrase off the display during setup and sends it out over the mobile network. That is also why Ledger’s Genuine Check, which verifies the authenticity of the security chip, cannot catch every physical alteration around it.
Part of the stolen funds has already been frozen. Tether froze roughly $10 million in USDT within hours of the first public reports. The attacker had already converted about $15 million into USDD, a stablecoin that Tether cannot freeze, per Bitquery. Other funds have moved through mixers, and PeckShield traced $3.89 million to Binance deposit addresses.
The scare may not be confined to Asia. On Sunday, a user reported that a device bought from an official European reseller contained the same implant. Ledger has not said whether it is aware of any European cases. CryptoBilis also distributes Trezor, Tangem, OneKey and SafePal devices, and none of those manufacturers has commented publicly on the safety of units sold through the reseller.
Ledger advises anyone who bought from CryptoBilis in the past 90 days not to set up the device. Owners who already set one up should move their assets to a new device with a fresh seed phrase. The case undercuts a core assumption of cold storage, that an offline device removes the need to trust intermediaries. It is likely to push buyers toward purchasing directly from manufacturers.
