Security update / Reviewed 18 October 20266 min read • Reviewed 18 Oct 2026

Ledger CryptoBilis hack: what is known and what to do

Reports of drained wallets have led to an investigation into Ledger devices sold through Southeast Asian reseller CryptoBilis. This update separates the company’s statements from estimates and practical precautions.

What has been reported

9 October: Ledger investigated fund-loss reports from CryptoBilis customers and asked the reseller to stop selling and shipping Ledger devices.
10 October: Ledger said one affected user’s device contained an unauthorized hardware implant. CryptoBilis halted sales of all hardware-wallet inventory during the investigation.
11 October: Ledger described the affected volume as limited and said all confirmed cases involved devices sold through CryptoBilis.
13 October: Ledger issued further buyer precautions and said it was reviewing reports from other locations, according to Decrypt. Its reported confirmed-loss scope remained CryptoBilis.
15 October: In its own published response, Ledger said genuine devices had been modified to capture recovery phrases during setup. It reported a sales suspension for authorized resellers and distributors in Southeast Asia and Hong Kong, clean sampled stock checks, and stricter handling rules.

The earlier statements are reported by The Hacker News; the 15 October statement was reviewed directly on Ledger’s website. They do not establish that every Ledger device is affected or that every device from the reseller contains an implant.

What is still uncertain

The final loss total, number of affected people, complete model and purchase-date scope, and any compensation outcome remain unsettled. On-chain analysts publish changing estimates with different address sets and valuation dates. Several addresses can belong to one person; transfers between attacker wallets must not be counted as new losses.

Bitquery’s analysis traces transactions; it is not a physical examination of each affected device. Ledger now describes a recovery-phrase capture mechanism, but that does not independently explain every reported loss. Treat claims about other resellers or universal device safety as unconfirmed unless current evidence supports them.

If you bought through CryptoBilis

Ledger’s initial warning covered purchases from that reseller in the preceding 90 days. Its subsequent 13 October precautions, reported by Decrypt, address CryptoBilis buyers without repeating that cutoff: do not initialize unused devices, contact Ledger Support, and move assets from an already-used device promptly to a new signer with a new recovery phrase. Do not enter or restore any recovery phrase on a CryptoBilis device. An older purchase date alone is not proof of safety.

Preserve purchase receipts, seller details, packaging and transaction IDs. Keep secrets out of screenshots and reports.
Do not reset, dismantle or discard a suspect device before asking official support about evidence preservation.
Use independently verified support to plan any transfer; check the destination and network carefully. Urgency does not make an unfamiliar signing request safe.
If funds are missing, report through the relevant platform and local authorities. A report cannot guarantee recovery.
Reject unsolicited recovery agents, seed-verification forms and extra payments to unlock funds.

Buying elsewhere does not replace good setup checks

Ledger’s published scope concerns confirmed CryptoBilis cases. That scope is an attributed investigation statement, not a guarantee about every other device. Check the purchase route, initialize the device yourself and follow current manufacturer integrity guidance. Supplied recovery words are a warning sign. Packaging and software authenticity checks should be treated as layers, not proof that every physical component is unmodified.

What the 15 October distribution changes mean

Ledger says its samples from stores and warehouses showed no tampering. Sampling cannot certify every device. The company says returned units must never be resold, even if they appear unopened, and stock must stay off display until handed to a buyer. These controls do not repair an already exposed recovery phrase or establish a compensation scheme.

Other brands: check the manufacturer’s own response

OneKey’s 12 October statement says it had no reports of related user losses and revoked CryptoBilis’s reseller authorization. It offers replacements for OneKey devices bought there from 1 March through 12 October 2026, with applications due 31 December 2026. Apply through the support button on the official OneKey website with proof of purchase. These are OneKey’s terms, not a Ledger refund or replacement programme.

A separate Ledger update issue also matters

Ledger Donjon’s August Security Bulletin 023 describes a signing-review issue fixed through rebuilt device applications. It tells users to update applications through Ledger Live and verify their versions on the signer; firmware updates alone do not establish that the affected apps were replaced. Ledger says it has no evidence of exploitation of that issue. This bulletin is separate from the CryptoBilis hardware investigation.

Check the source

Official and primary references

Ledger — response to the hardware implant attack, 15 OctoberDirectly reviewed company statement on modified genuine devices, sales suspensions, stock checks and reseller handling rules. These are Ledger’s findings, not an independent inspection by CryptooChai.Ledger Donjon update, 13 OctoberPrimary statement linked for readers; direct X retrieval was blocked. Buyer precautions were cross-checked against Decrypt’s reporting below.Decrypt — 13 October update and buyer precautionsReporting on Ledger’s support, evidence-preservation and new-recovery-phrase instructions.OneKey — CryptoBilis replacement responseDirectly reviewed 12 October statement; this manufacturer’s replacement terms do not apply to Ledger devices.Ledger Support — initial warning, 9 OctoberPrimary company warning and recent CryptoBilis-buyer precautions. X may require sign-in.Ledger Support — implant update, 10 OctoberCompany statement concerning one examined device and the ongoing investigation.Ledger — 72-hour update, 11 OctoberCompany statement about confirmed reseller-linked cases. These posts could not be retrieved directly during this review; the reporting below reproduces the statements.The Hacker News — 12 October reportingAccessible reporting of Ledger’s statements, the sales pause and buyer precautions.Bitquery — evolving on-chain investigationIndependent transaction analysis. Estimates can change; blockchain activity alone cannot establish how keys were exposed.Ledger Donjon — Security Bulletin 023A separate application-update issue disclosed in August, not evidence of the CryptoBilis attack mechanism.Ledger SupportNavigate independently to current official support. Never send a recovery phrase or PIN.