At a glance
- Ledger said on Sunday that “the volume of impacted devices is limited” and that all confirmed cases in the 9 Oct draining incident involve devices sold through CryptoBilis, a Southeast Asian reseller. It gave no device count and no loss total.
- Ledger told its authorized resellers and distributors “never to restock returned products”. One user’s post says a device bought in a European store held extra cables. Ledger answered his post only by pointing to its update.
Ledger said in a 72-hour update posted at 17:13 UTC (19:13 CEST) on Sunday that the number of devices affected in the CryptoBilis incident is limited, and that every confirmed case involves devices sold through the reseller.
“Our systems and direct sales channels remain unaffected,” the company said. It said it is working with authorities and reaching out to impacted users.
It repeated that CryptoBilis has confirmed it has ceased all hardware-wallet sales. It encouraged affected users to contact Ledger Support and to file complaints with local police.
Ledger said it is reminding authorized resellers and distributors to source products only through authorized channels and never to restock returned products. It strongly advised against buying from unauthorized sellers. It also said it is reviewing authorized-reseller controls and its anti-tamper processes, and thanked the security group SEAL 911 for its support.
For CryptoBilis buyers, the advice is unchanged from Saturday: do not initialize an unused device, and if one is already set up, move to a new seed on a device from Ledger.
Ledger’s post does not say how many devices were altered, how the implants got into them, or what share of the losses they explain.
The European report
Separately, a user who posts as 0xJohannes_ said on X at 11:11 UTC that a Ledger he bought in store from an official reseller in Europe a couple of weeks ago contained extra cables. He posted photos. At 19:06 UTC he wrote that Ledger had asked him to ship the device to it.
CryptoPotato reported that Ledger has not confirmed the case and that users disagree about what the photos show. Ledger’s 72-hour update does not mention it, and its reply to his post said only to refer to that update. We have not seen the device and cannot verify the claim.
On Sunday morning Ledger told another user it had “no indication” that devices bought on its own website were tampered with, in a reply on X.
Where the story stands
Ledger first said on 9 Oct that it was investigating. On Saturday it confirmed that one impacted user’s device “contained an unauthorized hardware implant”, as we reported. Blockchain-data firm Bitquery counted $92.9 million stolen from 311 wallets across five chains, its own figure, which Ledger has not confirmed.
Related: Where the money went
Another hardware-wallet maker, COLDCARD, said the same day that a phishing link was posted from its own X account. It is a separate incident.
What to watch: whether Ledger publishes a device count, and what it says after it has examined the device from Europe.
This article is for information only and is not investment advice.