If a hardware wallet comes from an authorized official dealer, can users be certain that the entire process from manufacturing to delivery is secure?
The CryptoBilis incident made this issue concrete.
On October 9, hardware wallet provider Ledger stated it is investigating an asset loss incident involving users in Southeast Asia. The affected users had purchased devices through the distributor CryptoBilis. Chain investigator Specter estimated that the associated asset losses may exceed $86 million, involving various cryptocurrencies such as Bitcoin and Ethereum, though this figure has not been independently verified.
The crypto media outlet The Block reported that CryptoBilis is listed as Ledger’s official distributor in Indonesia, Malaysia, and the Philippines. Ledger’s purchase guide recommends that users buy devices from official stores or authorized distributors and perform a Genuine Check during initialization.
If the authorized dealer itself encounters issues, to what extent can these security measures still protect users?
Authorized channels also have blind spots.
Ledger's purchase guide recommends that users buy devices only from official or authorized channels and perform authenticity verification. The former aims to reduce the risk of purchasing counterfeit products, while the latter checks whether the security chip inside the device is an authentic Ledger chip.
However, Ledger's buying guide also notes that the global supply chain cannot be completely immune to sophisticated interception or tampering attacks. Authorized identity and chip verification alone cannot prove that the entire device has not been compromised at any point from manufacturing to delivery.
In response to the CryptoBilis incident, Ledger has requested the distributor to suspend sales and shipments, and advises users who purchased devices through this channel within the past 90 days to take the following actions: if your device has not yet been set up, do not proceed with setup; if your device has already been set up, consider transferring your assets to a new Ledger device using a completely new recovery phrase.
CryptoBilis is listed as an official sales channel for Ledger, but its operating entity later changed. It is unclear whether Ledger was aware of this transaction or whether the authorization status will be re-evaluated following the change in control.
The boundary of authenticity verification
On October 9, Mark Karpelès, former CEO of Mt. Gox, displayed a Ledger Nano X suspected of containing spy components on X and publicly shared his research and disassembly findings.
The photos presented by Karpelès show that the shrink-wrapped outer packaging of the device was intact, but upon opening the casing, the implanted component was hidden in the space originally designated for cushioning foam, behind the OLED screen.
According to the disassembly records, the implanted component includes a microcontroller, a cellular communication module, an antenna, and an eSIM, connected to the screen's data lines. Its likely function is to read the content displayed on the device’s screen, identify relevant characters when a mnemonic phrase appears, and transmit the information via a cellular network.
This is a concerning attack vector, but the presence of the component does not confirm that attackers successfully stole the mnemonic phrase. The actual device behavior, whether any data was exfiltrated, and the identity of the perpetrator have not been sufficiently verified.
Other suspected compromised devices recorded by Karpelès also show design variations in the implanted components, including miniaturization via flexible printed circuits, removal of certain chip markings, and retention of the original battery. These design choices may make the components harder to detect, but their specific functionality and actual attack effectiveness still require further validation.
On October 10, 23pds, Partner and Chief Information Security Officer at SlowMist, analyzed that if additional circuitry could read screen data, it might theoretically capture the mnemonic phrase and transmit it via LTE module or eSIM. However, he emphasized that the related attack methodology remains speculative at this stage, requiring further analysis of samples and awaiting Ledger’s investigation results.
This case highlights the technical limitations of authenticity verification. Ledger’s security documentation states that the verification process is primarily designed to confirm whether the device’s secure chip is an original factory component. As long as the original secure chip remains intact, authenticity verification may fail to detect any additional hardware implanted in the device, and cannot be used to prove the physical integrity of the entire device.
The secure chip protects the private key and performs transaction signing within the device, but it cannot automatically guarantee that all surrounding circuits have not been modified. If additional components can read data displayed on the screen, the mnemonic phrase may still be exposed through another potential leakage pathway, even if the private key is not directly extracted from the secure chip.
However, there is currently no evidence linking the device displayed by Karpelès to CryptoBilis.
Ownership changed in March, announced in October.
The change in ownership of CryptoBilis adds another layer of context to this incident.
According to the crypto data platform RootData, Arravind Prabu, former co-founder of CryptoBilis, stated that the company was acquired in March 2026, after which the original shareholders stepped down from operations, management, and administrative roles.
Prabu responded on X that, due to confidentiality clauses in the contract, the original team must wait until October 19 to publicly announce the transaction. He also stated that the related posts on the CryptoBilis account following the incident came from the new management, not the original team.
Several months passed between the March acquisition and the October public announcement. According to company records cited by RootData, an individual named Jiaming has held all shares of CryptoBilis since August 3, though the original registration documents have not been reviewed. It remains unclear whether the March acquisition and the August full ownership stake involved a phased delivery.
Changes in equity ownership alone cannot prove that new shareholders were involved in equipment tampering or asset theft. Currently, it is confirmed that the original management team has stated its withdrawal from day-to-day operations, and the change in ownership of the distributor coincides temporally with the security incident. Whether there is a direct link between the two still requires further evidence.
The report also stated that CryptoBilis has suspended sales of all branded hardware wallets and closed its physical stores until further notice. This is a voluntary suspension by the distributor, and no issues have been reported with devices from other brands.
Where does the security responsibility lie?
Ledger stated that reports of related asset losses are currently concentrated among users in Southeast Asia who purchased devices through CryptoBilis; the company has not received any reports of similar issues from users who bought devices directly from Ledger’s official channels. Ledger also confirmed that its own systems have not been compromised and is currently investigating the incident.
The distinction between official channels and authorized distributors has become especially important in this incident. Purchasing directly from the brand’s official channel reduces users’ reliance on third-party distributors; however, regardless of the channel chosen, brand authenticity verification alone cannot prove that the device has never been tampered with throughout the supply chain.
For users, choosing official purchasing channels and completing device verification according to brand guidelines remains an important measure to reduce risk. However, when authorized distributors themselves become the subject of investigation, authorization status and authenticity verification alone are no longer sufficient to address all security concerns.
After the device leaves the factory, who can prove it hasn’t been tampered with?
The content in this article is for reference only and does not constitute any investment advice. The market carries risks; investments should be made with caution.