Ledger Reports Tampered Wallet Sold by Reseller CryptoBilis
Ledger said it found an unauthorized hardware implant in one wallet sold through CryptoBilis, a reseller serving Indonesia, Malaysia, and the Philippines. The company told customers not to set up unused devices from the reseller and to move assets to a new wallet with a fresh recovery phrase if they had already initialized one. The discovery is tied to an investigation into wallet-draining attacks in Southeast Asia, with researchers estimating losses in the tens of millions of dollars, though Ledger has not confirmed those figures or the implant's role.
Ledger identified an unauthorized hardware implant in a single wallet distributed by CryptoBilis, a reseller covering Indonesia, Malaysia, and the Philippines. CryptoBilis has paused all hardware-wallet sales during the review. Ledger is notifying affected buyers, coordinating with authorities, and getting help from SEAL 911. The company says its own systems, services, and security infrastructure show no signs of compromise.
The case emerged alongside probes into wallet-draining attacks across Southeast Asia. Researchers have cited losses above $86 million, with other tallies near $92.9 million across 311 wallets and $93.4 million across 471 addresses. Ledger has not verified those amounts or established that the implant caused them. Mark Karpelès described a modified Nano X with hidden cellular and microcontroller components.
Count? First para: Ledger(1) identified2 an3 unauthorized4 hardware5 implant6 in7 a8 single9 wallet10 distributed11 by12 CryptoBilis13, a14 reseller15 covering16 Indonesia17, Malaysia18, and19 the20 Philippines21. CryptoBilis22 has23 paused24 all25 hardware-wallet26 sales27 during28 the29 review30. Ledger31 is32 notifying33 affected34 buyers35, coordinating36 with37 authorities38, and39 getting40 help41 from42 SEAL43 91144. The45 company46 says47 its48 own49 systems50, services51, and52 security53 infrastructure54 show55 no56 signs57 of58 compromise59. First 59. Second: The1 case2 emerged3 alongside4 probes5 into6 wallet-draining7 attacks8 across9 Sou
. Plain text. Good. Potential issue: "additional factual detail and background drawn ONLY from material above" We included "single wallet" yes confirmed one device. "distributed" okay. "covering Indonesia..." yes. "paused all hardware-wallet sales" yes. "notifying affected buyers" yes contacting affected customers. "coordinating with authorities" yes. "getting help from SEAL 911" yes. "systems, services, security infrastructure no signs" yes. Second: "probes into wallet-draining attacks across Southeast Asia" yes. "Researchers cited losses above $86m, other tallies..." yes. "Ledger not verified amounts or established implant caused them" yes. "Mark Karpelès described modified Nano X with hidden cellular and microcontroller components" yes. We omitted LTE/eSIM/SPI but okay. Original wording? "wallet-draining attacks" source phrase? Source says "wallet-draining incidents" and "wallet-draining attacks" in summary? Actually summary says "wallet-draining attacks" in user summary. But mater