“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with a new seed).”
Ledger, advising customers of its reseller CryptoBilis
That is the company’s answer to a Ledger that steals your crypto: buy another Ledger. The advice arrived after users who bought hardware wallets through CryptoBilis, a Southeast Asian retailer, found their balances gone on October 9, and after Ledger confirmed a day later that at least one of those devices carried an unauthorized implant. On Tuesday the French company went further and asked resellers and distributors in seven markets, Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong, to take its products off the shelves. Through all of it Ledger has repeated one reassurance: there is “no indication” that its “direct sales channel” was compromised. Buy from the right place, the message goes, and you are fine.
Ledger’s own website says otherwise about what the right place was. Its official reseller directory, read on Wednesday, still lists “Cryptobilis” under both Indonesia and Malaysia, now with the suffix “Sales temporarily paused.” The store was never a gray-market stall. It was on the list Ledger tells you to buy from, and it has been paused rather than removed. The Malaysian section carries a second paused entry too, a Shopee Mall store that Ledger’s page labels “Ledger Authorized Reseller Store.” Ledger’s line, relayed widely, is that the volume of affected devices is “limited.” The directory shows the failure sat inside the channel Ledger itself vouched for.
The money is not limited. Bitquery, which traced every drained wallet across six blockchains, now counts $102.0 million taken from 324 wallets, up from the $86 million first reported off ten public addresses. Ledger says it has not verified any of the outside figures. The on-chain record is still unflattering: two weeks of small test transactions before the drain, then 25 TRON wallets signing the same approval within three seconds, which points to one thief holding every key. Tether froze $10.0 million. By Bitquery’s count about $84 million could still be found on-chain as of Tuesday, while the thief pushed roughly 6,840 ETH through Tornado Cash.
Here is why it worked, and why it should worry anyone who owns one of these things. A hardware wallet sells exactly one promise: your private keys live on a secure chip and never touch anything an attacker can reach. The implant did not attack the chip at all. It read the screen. During setup the device displays the 24 recovery words, and the implant, a microcontroller with a tiny eSIM and a shielded LTE module tucked behind the display, copied them and sent them out over the cellular network. Researchers at Tibane Labs found it built on a panelised flex circuit board of the kind ordered from a board house, which means somebody had them made professionally rather than soldering them by hand.
Ledger’s Genuine Check, the tool owners use to confirm a device is real, cannot detect an added implant when the original secure element is intact. The company says so itself.
Then the problem crossed a continent. A buyer in Germany reported an implant in a Ledger bought at a MediaMarkt store, and on Tuesday MediaMarkt Saturn, one of Europe’s largest electronics chains, stopped selling Ledger devices altogether. Ledger says that customer lost no funds and that it has verified no drain tied to a device bought outside Southeast Asia. Both of those statements can be true while the reassurance that matters, that the authorized channel was safe, has stopped holding.
For Ledger this is a balance-sheet problem as much as a security one. The company put its planned New York IPO on hold in May, a listing that had been explored at a valuation above $4 billion. A hardware wallet company does not have much of an asset base beyond its reputation for keeping keys safe. It now has no reseller sales across seven Asian markets and a pause at a major European chain, and it is steering buyers toward the one channel it will still stand behind: its own store.
Our view is blunt. Ledger is treating a supply-chain failure as a reseller problem.
The company chose its resellers. It listed them. It told customers to use them.
So it should own the fix. Publish the batches or serial ranges that passed through the paused channels. Ship free replacements, direct from Ledger, to anyone who bought through them. Put a reimbursement policy in writing, with terms and dates, where every affected buyer can find it, and say who pays for the “new Ledger signer” it keeps recommending.
And stop calling the list authorized until someone has audited it.