Quellengeprüfte Recherche: OKX

What Ledger said on 10 October

Ledger's support account posted a "Situation Update" that adds three things to its first statement of 9 October:

• Ledger "can confirm that one of the impacted users' devices contained an unauthorized hardware implant."
• Ledger is reaching out to impacted users as part of the ongoing investigation.
• Anyone with information is asked to contact the company; Cointelegraph reports the address given is Ledger's bounty programme, bounty@ledger.fr.

According to Cointelegraph's account of the same post, CryptoBilis confirmed it has stopped selling all hardware wallet inventory until the investigation ends, and Ledger is in active communication with the reseller about next steps. The practical advice did not change: anyone who bought from this reseller should not start the setup, and anyone who already set the device up should consider moving assets to a new Ledger signer with a new seed.

Ledger also told Cointelegraph that the incident appears isolated to a single reseller and its market, and that "Ledger's infrastructure, systems and services were not compromised." It has not published a figure for the losses or the number of customers involved.

Why one confirmed implant matters

Until Saturday the cause was a hypothesis. Our first report on the case, Ledger CryptoBilis wallet drains, described the supply-chain theory as possible but unconfirmed. Ledger's update moves it one step: at least one victim's device was physically altered after it left the factory, through a part Ledger did not put there.

That changes how buyers should think about risk in three ways.

1. The problem is the box, not the app. A software bug can be patched for everyone at once. A physical implant lives in one unit, so every device that passed through the same channel has to be treated as suspect until it is checked or replaced. 2. "Authorized reseller" is not the same as "sealed by the manufacturer". Ledger's reseller directory, which we read on 11 October, still lists CryptoBilis for Indonesia and Malaysia and CryptoBilis PH for the Philippines. The listing shows the channel was official; the implant shows that an official channel can still deliver a tampered unit. 3. One device is not all devices. Ledger confirmed a single implant. It has not said that every drained wallet involved one, and it has not described what the implant did. Treat the finding as strong evidence for one attack path, not as the full explanation.

The numbers so far

The $86 million figure is an investigator's estimate from on-chain tracing, repeated by Cointelegraph; it is not a Ledger number. Read it as an upper-range estimate that could still move as addresses are added or excluded.

What we still do not know

• What the implant does: whether it extracted the recovery phrase, replaced the random number generator, altered what the screen displays, or something else. Ledger has not said.
• Where in the chain the device was altered: at the reseller, in a warehouse, or in transit.
• How many CryptoBilis units carry an implant, and whether any device sold through another channel is affected. Ledger says it has no such reports.
• Whether victims will be compensated or any funds recovered.

We will not guess at these. Until Ledger publishes a technical report, any article that describes the implant's mechanism in detail is speculation.

What to do now

If you bought from CryptoBilis or CryptoBilis PH. Leave the device in its box and do not set it up. Contact Ledger support through support.ledger.com and keep the receipt and packaging; Ledger says it is contacting impacted users.

If you already set it up. Buy a replacement directly from Ledger, generate a fresh recovery phrase on the new device, and move your assets in one planned session. Do not import the old phrase into the new device: a phrase that may have been known to an attacker stays compromised whatever hardware holds it.

If your funds were drained. Record the transaction hashes and the receiving addresses and contact SEAL 911, which asked victims of these addresses to get in touch on 9 October. Be wary of anyone who offers to "recover" funds for an upfront fee.

If you bought from somewhere else. Ledger says it has no reports involving devices bought directly from it. Buying direct, checking that the packaging is intact, and never using a recovery phrase that came printed or pre-filled in the box remain the basic rules for any hardware wallet.

How to act on this

Moving to a new device sometimes means selling or rebalancing positions on an exchange while you wait for the replacement. If you do, keep the trading costs down rather than rushing: on OKX a regular account pays 0.08% maker and 0.10% taker on spot, and registering with code nexu888 returns 40% of trading fees, settled hourly. Exchange custody is a different risk from self-custody, so treat it as a short stop, not a home. Compare venues on /rates, check current campaigns on /activities, and read the OKX profile before you sign up.

Quick answers

Did Ledger confirm the CryptoBilis devices were tampered with? Ledger confirmed that one impacted user's device contained an unauthorized hardware implant. It has not said how many devices were altered.

How much was stolen? Investigator Specter estimated more than $86 million across Ethereum, Tron and Bitcoin. Ledger has not confirmed a figure.

Was Ledger itself hacked? Ledger says its infrastructure, systems and services were not compromised and that the incident appears isolated to one reseller and its market.

Is CryptoBilis still selling Ledger devices? According to Ledger's update as reported by Cointelegraph, CryptoBilis has stopped selling all hardware wallet inventory until the investigation is concluded.

Should I stop using my Ledger? Only devices from this reseller are named. If yours came from Ledger directly, Ledger reports no related cases.

Limits

This update relies on Ledger's posts of 9 and 10 October, Ledger's reseller directory read on 11 October, posts by Specter and SEAL, and Cointelegraph's report of 11 October. Loss figures are investigator estimates. We have not examined any device. Fees come from NexuAlpha's partner feed checked on 10 October and can change. This is not security or investment advice. Partner links may earn NexuAlpha a commission paid by the exchange, at no extra cost to you.