started · updated
Ledger investigates hardware implants in devices sold via CryptoBilis
Ledger is investigating a supply chain attack involving unauthorized hardware implants in its devices. The company confirmed that at least one affected device contained a malicious component, which reportedly monitors the display bus to capture the 24-word recovery phrase during the initial setup process.
All confirmed cases of asset theft are linked to devices sold through the Southeast Asian distributor CryptoBilis, which was an authorized reseller in Malaysia, Indonesia, and the Philippines. Ledger has requested that CryptoBilis suspend all sales and shipments of its products pending the investigation.
Blockchain analysis firm Bitquery estimates that approximately $93.2 million in assets across 315 wallet addresses have been stolen across six blockchains, including Bitcoin, Ethereum, and Tron. Tether has reportedly frozen approximately $10 million in related USDT assets. While reports of compromised devices have surfaced in Europe, Ledger has not yet confirmed if these cases are linked to the same supply chain breach.
Entities
Arkham Intelligence · Bitcoin · Bitquery · Changpeng Zhao · CryptoBilis · Ethereum · Ledger · Mark Karpelès · Southeast Asia · Specter · Tether
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 24 SOURCES] Ledger has not confirmed the specific amount of losses or whether hardware devices were tampered with. coinacademy.fr · www.crypto-insiders.nl · portaldobitcoin.uol.com.br · blogtienao.com · airdropalert.com · +9 more
- [● 26 SOURCES] Users who have already set up their devices are advised to transfer assets to a new device with a new recovery seed phrase. coinacademy.fr · www.crypto-insiders.nl · portaldobitcoin.uol.com.br · blogtienao.com · airdropalert.com · +11 more
- [● 27 SOURCES] Ledger is investigating reports of fund losses among users in Southeast Asia who purchased devices from the reseller CryptoBilis. coinacademy.fr · www.crypto-insiders.nl · portaldobitcoin.uol.com.br · www.numerama.com · blogtienao.com · +11 more
- [● 26 SOURCES] Users who purchased a device from CryptoBilis in the last 90 days are advised not to set up their device if they have not already done so. coinacademy.fr · www.crypto-insiders.nl · portaldobitcoin.uol.com.br · blogtienao.com · airdropalert.com · +11 more
- [● 26 SOURCES] Ledger has requested that CryptoBilis suspend all sales and shipments of its devices. coinacademy.fr · www.crypto-insiders.nl · portaldobitcoin.uol.com.br · www.numerama.com · blogtienao.com · +11 more
- [● 25 SOURCES] On-chain analysts estimate that over $86 million in cryptocurrency has been stolen. coinacademy.fr · portaldobitcoin.uol.com.br · www.numerama.com · blogtienao.com · airdropalert.com · +11 more
- [● 3 SOURCES] Mark Karpelès claims a Ledger device from Malaysia contained a spy module with LTE, eSIM, and antenna components. www.bitcoinsistemi.com
- [● 3 SOURCES] Bitquery estimates the loss at $92.9 million across 311 wallets and 5 blockchains. bittimes.net
- [○ 1 SOURCE] Paxos has added XRP support to its crypto brokerage service. bittimes.net
- [○ 1 SOURCE] iTrustCapital reported that Bitcoin accounts for more than 50% of the assets held for its 100,000 high-net-worth clients. bittimes.net
- [○ 1 SOURCE] There is no evidence that the XRP Ledger vulnerability was exploited in the live network. bittimes.net
- [● 13 SOURCES] Ledger has launched an investigation into fund outflows affecting users who purchased devices through the vendor CryptoBilis. bittimes.net · mastand.com · nosmokesport.com · coinacademy.fr · blogtienao.com · +6 more