Author: Gu Yu, ChainCatcher
Someone transferred 80 bitcoins into a newly purchased Ledger. The device was bought from an official authorized reseller, and the seed phrase was handwritten and locked in a safe. The coins only arrived on September 29, with a purchase cost of about $5.2 million and unrealized gains that at one point reached $1.38 million. On October 9 at 05:54 (UTC), all 80 BTC were transferred out in a single transaction.
He did everything the textbook required.
That same morning, waves of similar reports began appearing on X and Reddit: one user's Ledger Stax had nearly 100,000 USDT transferred away, with the seed phrase likewise handwritten and locked in a safe. These users had only one thing in common—all their devices were purchased from the Southeast Asian reseller CryptoBilis.
On October 9 at 13:32 (UTC), Ledger confirmed it was investigating and asked CryptoBilis to suspend all sales and shipments of Ledger devices; users who bought devices from that channel within 90 days should not initialize them if they had not yet done so, and those who had already initialized them should immediately move assets to a new device generated with a new seed phrase.
I. Losses May Exceed $90 Million
How large the losses actually are currently exists only as on-chain estimates.
On-chain investigator Specter first published ten consolidation addresses at 12:24, covering Bitcoin, Ethereum, and Tron, estimating losses at more than $86 million; another investigator, tanuki42, listed eight of those addresses and gave a figure of more than $72 million; SlowMist's MistTrack said the number was "approaching $90 million"; Bitquery covered 311 wallets and estimated about $92.9 million, including about $42 million in Ethereum, about $17.6 million in Bitcoin, and about $16.5 million in USDT. Arkham has labeled these addresses as "Ledger Theft," and as of Friday afternoon, about $71.5 million still remained in the flagged addresses, with the largest positions including about $29.4 million in ETH, $17.5 million in BTC, $13.6 million in USDD, and $10.8 million in USDT.
More noteworthy than the total is the victim profile. Lookonchain detected that one address deposited 7 million USDT after purchasing a device three weeks earlier, and all of it was transferred out about ten hours before the reports, possibly the largest single loss in this incident; three other flagged Bitcoin addresses held about 211 BTC in total at 13:44 (UTC), with no outflows at that time. According to Chain INK, this incident involved about 98 wallets, averaging about $890,000 each.
This is not retail investors losing a few hundred dollars. This is the kind of wallet where someone puts their life savings.
Put it alongside another incident this year, and the difference in distribution says more than the total. In July, Coldcard suffered a firmware random-number flaw that made seed phrases inferable, causing about $111 million in losses, but spread across more than 5,200 wallets, averaging about $21,000 each; by contrast, the CryptoBilis incident ranked second in less than a day (about $87 million), yet involved only about 98 wallets, averaging close to $890,000.
The Coldcard case was broad-net fishing; this one was precision harvesting. This distribution itself supports the inference of an "implanted module": the attacker possesses the seed phrase generated on every modified device, so they can wait—wait for the money to come in before acting, and specifically target those worth acting on. The 80 BTC monitored by Lookonchain were transferred out all at once after quietly sitting in the device for ten days.
II. After Opening the Device: The Microcontroller on the Screen Ribbon Cable
Ledger has not yet explained the attack mechanism, but someone has already taken the device apart.
The most specific description comes from former Mt.Gox CEO Mark Karpelès. He said a device he received came from Malaysia—listed on Amazon at half price and shipped from Malaysia rather than the Japan he had ordered from, and the shipping origin itself was the first warning sign. After opening it, he found a hidden module where the screen padding should have been: a single strand of antenna wire, space freed up by a shortened battery or removed screen padding, an LTE module with eSIM, and a microcontroller connected to the device's SPI bus.
His assessment is that this microcontroller can recognize the font Ledger uses on its 128×64 screen, lock onto the seed phrase setup interface, and send the seed phrase displayed character by character as the user writes it down as text via LTE.
SlowMist Chief Information Security Officer 23pds gave the corresponding technical path: the attacker installs a microcontroller inside the device and taps into the screen's SPI data line; after the seed phrase is generated inside the secure element and displayed on the screen for the user to copy down, the malicious module synchronously records every character output by the screen and then transmits it via built-in LTE or eSIM. He emphasized that the role of the secure element is to prevent the private key from being directly read or exported, but it cannot control what is being displayed on the screen—the few seconds when the seed phrase appears on the screen are the attack window.
This explains the most counterintuitive point of the entire incident: these devices can pass Ledger's authenticity verification. Because the secure element is genuine, it does correctly generate the seed phrase and does sign normally; it is merely being "watched." Firmware likewise cannot detect it, because the implanted module only listens when the screen refreshes. In other words, the only way to detect it is—to open the device.
Two other possibilities also exist: one is a preloaded seed phrase—the attacker powers on the device in advance, sets it up, copies down the phrase, and repackages it, so the user thinks they are "setting up a new device" but is actually using a phrase the other party already controls; the other is phishing. Developer 0xQuit believes some victims may have fallen to phishing, saying it is irresponsible to directly say "Ledger was hacked."
III. "Official Authorization" Endorses Selling Rights, Not the Supply Chain
CryptoBilis is not some fly-by-night operation.
Founded in Kuala Lumpur in 2020, it is an official authorized reseller listed in black and white on Ledger's official reseller page, covering Malaysia, Indonesia, and the Philippines, and in addition to Ledger it also sells Trezor, OneKey, Tangem, and SafePal.
The problem lies precisely here. Users followed the security principle the industry taught them: if you cannot get direct shipping from the official website, find an "official authorized reseller." But authorization endorses this company's reseller status, not the integrity of every device in its warehouse, nor every employee who handles sorting. From the moment a device leaves the factory, it goes through logistics, warehouses, sorting, the reseller, and then to the doorstep; any link in this chain could be intercepted, opened, and restored—the shrink wrap on Karpelès's device was intact.
Once a device leaves Ledger's custody, the word "authorized" no longer provides any physical guarantee.
More subtle is the timeline. Newly disclosed corporate records show that CryptoBilis was acquired in March this year, and a person registered at an address in Heilongjiang Province, China, named "Jiaming," has held 100% equity in the company since August 3. A former co-founder confirmed the March acquisition, saying the original shareholders subsequently withdrew from all operational, managerial, and administrative roles, and after the handover could no longer learn about the company's actual operations, and urged current management to handle the matter transparently. According to Shenchao TechFlow, a confidentiality agreement signed between the acquirer and former executives restricts disclosure of transaction details and remains in effect until October 19—when the incident erupted on October 9, the former executives were legally unable to freely disclose the acquisition details.
There is currently no conclusive evidence that the equity change is connected to the device thefts, and Ledger has only suspended sales without making any accusations.
On October 10, CryptoBilis announced the suspension of sales and shipments of all brands of hardware wallets across all stores and online channels in Malaysia, the Philippines, and Indonesia, and reminded users: the seed phrase must be generated by the device itself during initialization and handwritten by the user; if a device comes with a card with the seed phrase already printed or written on it, it should be regarded as unsafe.And CryptoBilis is not the only channel that has run into trouble this year. In September, Trezor admitted that its logistics contractor ShipMonk had been breached, exposing the real names, phone numbers, and home addresses of about 81,000 U.S. customers; in January of this year, Ledger disclosed that payment processor Global-e had leaked the names and contact information of some buyers on its official website. These incidents did not directly result in lost coins, but they handed the list of "who received a hardware wallet and when" to attackers, again and again.
Over the past three months, the weakest link in cold storage has shifted from code to logistics.
IV. Recovery, Self-Rescue, and That Cheapest Piece of Advice
The recovery window is closing.
According to MistTrack, Tether has frozen a large amount of USDT at the relevant addresses; the attacker then began swapping USDT into USDD—a TRON stablecoin that Tether cannot freeze. According to Onchain Lens, 430.2 ETH (about $1.07 million) has already entered Tornado Cash through four wallets. Bitcoin and Ethereum have no freeze switch. Once the money leaves, only exchanges remain as a checkpoint.
SlowMist and Security Alliance have opened help channels, with the latter calling on users whose funds were transferred to the relevant addresses to contact its SEAL 911 emergency response team.
Among the advice offered by the industry, the most practical piece comes from CZ. While judging this to be "a supply chain attack limited to a certain distributor," he gave a plan specific down to the action:
"After buying a hardware wallet (or downloading a new software wallet), let it sit for a few weeks before transferring any meaningful amount into it. During those weeks, keep following the relevant news... Hardware can be tampered with, and the official website of software can also be attacked. Self-custody means extra responsibility."
The logic of this "quarantine period" is not technical but informational: if a batch of devices has already been tampered with by the time it reaches the distributor, on-chain analysts need time to discover the first thefts and issue alerts—those two weeks are the time you buy for yourself.
But what this incident truly rewrites is the boundary of the word "self-custody."
Over the past decade, the industry built the security narrative of self-custody almost entirely on cryptography and hardware: secure elements, EAL5+, PIN wipe, open-source audits. None of these were broken. What was broken was the stretch of road from the factory to your doorstep—a road made up of logistics providers, warehouses, distributors, and couriers, where no link can be verified by the user.
A hardware wallet promises that "the private key never leaves the device." The irony this time is that the private key indeed never left the device—it was simply glanced at by someone else during the few seconds it was displayed to the user.
And when the security boundary expands from the chip to the courier at your doorstep, the last line of defense a user can really hold may indeed be only this: don't rush to put money in.