Ledger Ties Confirmed Wallet Drains to CryptoBilis Reseller

Ledger says every confirmed case in the Oct. 9 wallet-draining incident involved devices sold through Southeast Asian reseller CryptoBilis, but it has not disclosed a total loss figure. A hardware wallet stores the private keys that control crypto and uses them to authorize transactions. Ledger’s Oct. 11 update, reported by Unchained, said the number of impacted devices was “limited” and that Ledger’s systems and direct sales channels remained unaffected.

The basic chain is: a device holds the keys; the owner uses it to approve a transaction; the network records that signed transaction. A recovery phrase can restore access to those keys on another signer. If someone gets the phrase, they may be able to move the assets without the owner approving a transaction on the original device. Ledger has confirmed hardware tampering on one impacted device, but has not explained how the confirmed drains happened.

What did Ledger confirm about CryptoBilis devices?

Ledger confirmed that one affected user’s device contained an unauthorized hardware implant, according to BleepingComputer’s report. The company had opened an investigation after users reported losses and asked CryptoBilis to stop selling and shipping Ledger devices on Oct. 9. Ledger’s later update tied all confirmed reports to devices sold by the reseller. It did not say how many devices were affected, identify the compromised model or explain when or where the hardware was altered.

That leaves an important gap between what is known about one device and what caused each reported loss. BleepingComputer reported that security researchers described implants in Ledger X devices, but Ledger has not publicly confirmed that model as the one involved in the incident. The reported research does not establish the implant’s role in every confirmed drain.

How much crypto was taken?

Ledger has not provided its own loss total. Onchain estimates reported by Unchained differ: Bitquery counted $93.2 million across six blockchains and 315 wallets, while YFarmX estimated $103.4 million across seven blockchains and 530 addresses. Those are tracker estimates, not a figure confirmed by Ledger. Blockchain transfers can show where assets moved, but they do not by themselves establish how a wallet’s keys were exposed.

What did Ledger advise affected buyers to do?

Ledger advised customers who bought through CryptoBilis not to set up unused devices. Those who had already set one up were told to consider moving assets to a new Ledger signer with a new recovery phrase. CryptoBilis had stopped selling hardware wallets while the investigation continued, according to Ledger’s update as reported by Unchained. Ledger also said it was working with authorities and reviewing controls for authorized resellers.

Source material

• Unchained — unchainedcrypto.com
• BleepingComputer’s report — bleepingcomputer.com