Ledger warns buyers of devices from CryptoBilis in past 90 days against setting them up
Key Facts
Ledger warned customers who bought its devices from distributor CryptoBilis in the 90 days preceding the warning against setting them up, following an incident involving lost funds that prompted broader precautions across its distribution channels. Cointelegraph reported the warning to those buyers, which concerns the device setup stage. In a statement dated October 15, 2026, the company asked its authorized distributors to suspend sales in Southeast Asia and Hong Kong. The expanded suspension formed part of its subsequent response to the incident involving the distributor in the region. Ledger said in the statement that a criminal group had returned devices to distribution channels after secretly modifying them.
On suspected losses, The Block cited an estimate based on tracking on-chain transfers of more than $72 million. The publication reported another estimate of more than $86 million across Bitcoin, Ethereum and Tron. The estimates remained separate at the time of the initial report, and Ledger had not confirmed either estimate or that all the transfers were linked to the distributor incident. The $86 million figure was therefore neither an announced ceiling on losses nor a final total acknowledged by the company. Regarding the security of its services, Ledger said its infrastructure, systems and services had not been compromised, according to Cointelegraph.
In its subsequent statement, Ledger described a sequence that began with the criminal group buying genuine devices, then opening them and adding hidden components inside. It said the components were added to "capture the recovery phrase during setup" before the devices were returned to distribution through distributors in Southeast Asia. In an explanation of the security architecture published on October 15, 2026, Charles Guillemet, the company's chief technology officer, discussed the limits of cryptographic verification of software authenticity within the secure chip. He explained that this verification cannot detect an implanted component spying on the screen. His explanation thus placed physical device tampering in a different category from the software authenticity checks performed by the chip.
As part of checks on sales channels and inventory, Ledger said it sent teams to buy devices from stores, including stores in Germany. It added that it also inspected samples from warehouses, saying of the results: "All units inspected were intact." On returns, the company reiterated a ban on reselling devices returned by buyers, even when they appear new and sealed. Its additional instructions included keeping inventory at the back of the store instead of placing devices on display shelves. It asked that devices be handed to buyers at the time of purchase, as part of its procedures for storing, displaying and handing over units at points of sale.
The precautionary response extended to OneKey, which announced in an update dated October 12, 2026, that it had revoked CryptoBilis's authorization as an official distributor of its products. It said it had received no reports of users losing assets linked to the incident, while stressing that the absence of reports did not mean there were no risks. It also stopped adding new distributors to its network and began reviewing all existing distributors again. The review included verifying each distributor's business entity and ultimate beneficial owner, according to the company's update. OneKey said it would revoke the authorization of any distributor whose entity or owner could not be verified, extending its measures to the existing distribution network alongside the suspension of its expansion.
Ledger has a separate security incident dating back to July 2020, when a cyberattack led to a data leak. The company's chief executive acknowledged that incident in a letter dated December 21, 2020, while the current incident concerns physical modifications made to genuine devices. In its security explanation published on October 15, 2026, the company said it had developed an active shield around the secure area in the Ledger Atom device. The shield was designed to detect attempts to touch, open, probe or modify the device before it reaches the buyer. The protection described by the company covers attempts at physical interference, the aspect addressed in its chief technology officer's explanation of the limits of software verification.
On next steps, Ledger pledged in its October 15, 2026, statement to publish additional details about the incident when circumstances permit. It said it would also provide a broader technical disclosure to companies in the industry to help them strengthen protection for their products. The pledge comes alongside the company's instructions on inventory and returns and the suspension of distributor sales in the regions covered by its measures. OneKey, for its part, tied its distributors' continued authorization to the results of the review announced in its October 12, 2026, update. Its announced steps include completing verification of existing distributors and revoking the authorization of those whose business entity or ultimate beneficial owner cannot be verified.