Ledger Confirms Hardware Implant in CryptoBilis-Sold Device; CZ Had Warned

Lead

Ledger confirmed an unauthorized hardware implant in at least one device sold by Southeast Asian reseller CryptoBilis, per CoinDesk's October 13 reporting on the disclosure. The mechanism was characterized as a chip that transmitted wallet seed data over a mobile network — an account CoinDesk attributes to Ledger's disclosure rather than independently reconstructed. Four days earlier, Binance co-founder Changpeng "CZ" Zhao had warned on X of a "localized" supply-chain attack tied to "one vendor," without naming CryptoBilis.

Background

CoinDesk's reporting on the Ledger episode came in two stages. On October 9, it said Ledger was investigating potential wallet tampering after reports of roughly $86 million in user-reported crypto losses — a figure CoinDesk attributed to secondary reporting and user complaints, not an internally confirmed Ledger loss total. On October 13, CoinDesk reported the Ledger confirmation naming CryptoBilis as the reseller whose supply chain carried the tampered unit.

CZ's October 9 post called Ledger "one of the most secure and oldest hardware wallets in the industry" and framed the issue as "a supply chain attack with one vendor," distinguishing it from a flaw in Ledger's own manufacturing. He also said he expects "all BNB ecosystem players (and all industry) to help trace and recover the funds" — an informal call for cross-industry cooperation rather than a named recovery plan, and he did not identify which wallets, exchanges, or security firms are currently involved in any tracing effort.

Three distinct gaps in the public record remain as of this writing, each checked separately. No dedicated incident advisory tied to this disclosure was located on Ledger's official security advisories page in a check conducted at publication time — though CoinDesk's reporting describes Ledger investigation updates posted on X, meaning official communication exists on that channel even if a dedicated advisory page does not. No list of affected serial numbers or specific device models has surfaced through Ledger's channels or CoinDesk's reporting. And no public reimbursement path or affected-customer process has been announced in either source. CZ named neither the vendor nor the evidence base for his "one vendor" framing.

What it means

CoinDesk's reporting describes Ledger's own guidance for buyers who obtained devices through the affected channel: a device not yet set up should not be initialized, and a device already in use requires moving funds to a new wallet with a new recovery phrase. These are the subject-specific instructions attributed to Ledger — not generic advice — and should be the first thing a potentially affected buyer acts on.

As a general practice unchanged by this incident, hardware wallets are purchased directly from the manufacturer or an authorized retailer, and a recovery phrase that came pre-provided with a device is never used. Neither a firmware check nor a two-week waiting period is a confirmation that a device is uncompromised — these are risk-reduction practices, not safety guarantees. CoinsCipher will update this article if a dedicated incident advisory, a serial-number list, or a reimbursement path is announced through Ledger's own channels, or if additional reporting narrows the scope.