Tampered Ledger wallets sold in Southeast Asia
Where it stands now. Ledger has traced all confirmed thefts to devices sold by CryptoBilis and has asked sellers in seven Asian markets to stop selling its wallets.
The record 2 developments
Ledger asks retailers in Southeast Asia, Hong Kong to stop sales
What happened. Ledger said on 12 October that all confirmed thefts in its supply-chain investigation involve devices sold by reseller CryptoBilis, which operates in Malaysia, the Philippines and Indonesia. Security researchers' teardowns found an LTE modem, eSIM and antenna fitted inside the devices to send out 24-word recovery phrases; loss estimates range from over US$86 million (on-chain investigator Specter) to US$102 million from 324 wallets (Bitquery). By 14 October Ledger had asked sellers in Malaysia, Singapore, Indonesia, Thailand, the Philippines, Vietnam and Hong Kong to stop selling its wallets.
Why it matters. Ledger said the parts were inserted at the distribution stage by an organized crime group, and said its own manufacturing, internal systems and direct sales were not compromised; on 11 October it said it could not rule out other distributors being affected. Ledger told users with active devices bought from CryptoBilis to move their assets to a new address on an uncompromised signer.
- Ledger told its authorised distributors never to restock returned devices and to buy stock only directly from the factory.
- Ledger said it is working with local authorities and the security group SEAL 911, and contacting affected users directly.
- Unconfirmed social media posts describe similar modified devices bought from retailers in Europe; Ledger says all confirmed cases trace back to CryptoBilis.
Read the originals (12), usually in their own language
- Ledger Attributes All Confirmed Wallet Losses to CryptoBilis as Unverified Reports Surface in Europe · BitPinas
- Ledger Extends Regional Retail Freeze Across SEA and Hong Kong as Teardowns Find Spy Implants Beyond CryptoBilis · BitPinas
- (no headline in the material) · TechFlow
- Ledger Probes Suspected US$86M Crypto Theft Linked to Malaysia’s CryptoBilis · Fintech News Malaysia
- Ledger CryptoBilis Theft Estimate Rises to US$102 Million, Says Bitquery · Fintech News Malaysia
- Ledger Calls for Crypto Wallet Sales Halt Across Southeast Asia, Hong Kong · Fintech News Malaysia
- Crypto wallet giant Ledger confirms malicious hardware inside affected devices · CoinPost, headline translated by us
- Malicious device found in Ledger bought on Amazon by former Mt. Gox CEO · CoinPost, headline translated by us
- Ledger says malicious-component attack was organized crime targeting distribution; publishes countermeasures · CoinPost, headline translated by us
- After Southeast Asia, Ledger faces accusations of spy hardware in wallets sold in Europe · Blogtienao, headline translated by us
- More Ledger wallets found with foreign components in Europe and Singapore · Coin68, headline translated by us
- From one distributor to regional pull-back! Ledger shrinks Asian channels, orders Singapore, Malaysia, Hong Kong and other distributors to stop sales · Zombit, headline translated by us
Ledger asks Southeast Asian reseller to pause sales over drained-wallet reports
What happened. On October 9, Ledger said it was investigating reports of lost funds from Southeast Asian users who bought devices from the reseller CryptoBilis, and asked it to pause all sales and shipments. Estimates of the amount drained range from more than $80 million (Arkham, via BitPinas) to over $90 million (Crypto Times, BlockTempo). Corporate filings reported by BitPinas and TechFlow show the reseller changed owners this year; investigators have not linked the ownership change to the device tampering.
Why it matters. Ledger told buyers from CryptoBilis in the last 90 days not to set up new devices, and told those who already had to move their funds to a new wallet with a new recovery phrase. Security researchers cited by BitPinas reported that some devices shipped through the reseller had physical modifications designed to extract recovery phrases.
- Corporate filings show all of CryptoBilis's shares passed in August to a new owner registered in Heilongjiang province, China, after a sale that closed in March; a non-disclosure agreement kept the former owners from announcing it.
- A former co-founder said the original owners handed over all access after the sale and have had no view of the business since.
- CryptoBilis, a reseller based in Malaysia and the Philippines that also sells Trezor wallets, suspended sales and shipments of all hardware wallet brands.
Read the originals (8), usually in their own language
- Ledger Asks MY and PH-based CryptoBilis to Pause Sales Amid User Reports of Drained Funds, Security Concerns · BitPinas
- Founder Confirms CryptoBilis Sold Before Ledger Supply Chain Attack: What Hardware Wallet Owners Must Do · BitPinas
- (newsletter item, no headline in material) CryptoBilis ownership change and supply chain investigation · TechFlow
- Trader loses USD 6.6 million in Bitcoin after buying a new Ledger wallet · BeInCrypto Thailand, headline translated by us
- Ledger wallet hack: 86.9 million dollars drained from 98 wallet addresses · Blogtienao, headline translated by us
- One of the most popular crypto wallets reportedly hacked, with significant losses · Blogtienao, headline translated by us
- Funds lost from crypto wallets bought at authorized stores? Losses may be $90 million · Crypto Times, headline translated by us
- Ledger cold wallets allegedly drained of over $90 million! 'Supply-chain tampering', distributor changed hands to an unknown Chinese person · BlockTempo, headline translated by us