Hardware wallet manufacturer Ledger stated that all confirmed cryptocurrency thefts linked to an ongoing supply chain investigation involve devices sold exclusively by Southeast Asian reseller CryptoBilis, even as unverified reports of tampered units surface in European retail markets.
In a 72-hour investigation update released Oct. 12, the French company confirmed that its internal manufacturing infrastructure, internal systems, and direct sales channels remain uncompromised. The company noted that the volume of impacted devices remains limited and that its security team is contacting affected users directly while coordinating with local law enforcement authorities and web3 security coalition SEAL_911.
The update follows the Oct. 9 discovery of physical hardware modifications inside devices sold through CryptoBilis, a reseller operating across Malaysia, the Philippines, and Indonesia. Hardware teardowns published by security researchers showed custom circuitry, including a Nordic Semiconductor LTE modem, an embedded eSIM module, and a micro-antenna, soldered directly onto circuit boards behind the OLED display. The modified components were engineered to intercept 24-word recovery seed phrases upon generation and transmit them silently over local cellular networks.
While Ledger maintains that all confirmed compromises trace back to CryptoBilis, unconfirmed reports posted on social media platforms indicate similar hardware alterations discovered on devices purchased from third-party electronics retailers in Europe. Security analysts warn that supply chain vulnerabilities may extend beyond a single regional distributor if compromised inventory was transferred across secondary distribution nodes.
Corporate records show CryptoBilis underwent a full acquisition in March, with 100% of company shares transferred to a Chinese national in August under a non-disclosure agreement that prevented the former owners from publicly disclosing the sale. CryptoBilis subsequently suspended all retail operations and online sales across Southeast Asia. (Read More: Founder Confirms CryptoBilis Sold Before Ledger Supply Chain Attack: What Hardware Wallet Owners Must Do)
Ledger issued strict operational guidelines directing all authorized distributors never to restock returned hardware and to source products strictly through direct factory channels. The manufacturer advised customers who purchased devices from CryptoBilis to leave uninitialized units sealed. Users operating active devices bought through the reseller were instructed to transfer assets immediately to a new address generated on an uncompromised signer.
Disclosure: AI is used to assist in developing this story.
This article is published on BitPinas: Ledger Attributes All Confirmed Wallet Losses to CryptoBilis as Unverified Reports Surface in Europe
What else is happening in Crypto Philippines and beyond:
