Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Ledger devices sold through CryptoBilis hit by network compromise

Incident
First reported
Last updated
Happening score
H score 12
1 unique sources, 1 articles

Summary

Hide ▲

Ledger confirmed that devices sold through CryptoBilis were compromised with a hardware implant that drained users' cryptocurrency wallets. The compromised units were distributed through a Southeast Asian reseller, creating direct theft risk for affected buyers. Ledger is reaching out to impacted users while the investigation continues.

Related Happenings

Malicious actor campaign expands across multiple victims

Campaign
H score14 First: 14.04.2026 19:37 Last: 14.04.2026 19:37 Sources 1

About this happening: A fake Ledger Live app in Apple’s App Store drained about $9.5 million in cryptocurrency from 50 victims in a few days, indicating a broader wallet-theft campaig...

Open Happening

Timeline

  1. 12.10.2026 19:27 1 articles · 1h ago

    Tampered Ledger X wallets circulate through reseller channels

    Exploitation Observed

    Researchers said tampered Ledger X devices were already circulating by September 16 and were being sold for nearly half the price of the original hardware, showing compromised wallets had entered reseller channels before Ledger's later confirmations.

    Show sources
    Open in new tab
  2. 12.10.2026 19:27 1 articles · 1h ago

    Ledger launches an investigation into CryptoBilis wallet losses

    Initial Disclosure

    Ledger launched an investigation into reports of cryptocurrency losses from wallets purchased through CryptoBilis and asked the Malaysia-based reseller to stop selling and shipping Ledger devices.

    Show sources
    Open in new tab
  3. 12.10.2026 19:27 1 articles · 1h ago

    Ledger confirms an unauthorized hardware implant in an impacted device

    Victim Impact Update

    Ledger confirmed that one impacted user's device contained an unauthorized hardware implant, said it was reaching out to affected users, and warned buyers not to begin setup on untrusted devices or to move assets to a new signer with a new seed if the device was already initialized.

    Show sources
    Open in new tab
  4. 12.10.2026 19:27 1 articles · 1h ago

    Ledger links all reported wallet drains to CryptoBilis devices

    Attribution Update

    Ledger later said every user report of unexpected fund drains was linked to devices sold through CryptoBilis and described the affected volume as limited.

    Show sources
    Open in new tab
  5. 12.10.2026 19:27 1 articles · 1h ago

    Researchers detail Ledger X hardware implants hidden in compromised wallets

    Technical Analysis Update

    Tibane Labs said there were two implant versions for Ledger X, including one built around an ST STM32G431KBU6, a tiny eSIM, and a shielded LTE module, and another that fit into the space under the OLED display foam padding with markings scraped off the MCU and eSIM. The researchers said the actor replaced the original battery with a smaller one to make room for the malicious circuitry and noted that the specimen used a designed, panelised flex PCB rather than a hand-built one-off.

    Show sources
    Open in new tab