ANOTHER ATTACK VIA HARDWARE WALLET Someone has acquired a company within Ledger’s official distribution network in Southeast Asia and, according to allegations, used the company to sell tampered devices. CryptoBilis operated in Malaysia, Indonesia, and the Philippines. Since yesterday, wallet drains linked to customers who purchased from them have emerged; on-chain estimates suggest over $80 million (Bitcoin, Ethereum, Tron), a figure not yet confirmed by Ledger. The most widely cited hypothesis is a supply chain attack: devices equipped with a hidden surveillance module (an LTE chip installed where the screen pad should be, connected to the device’s bus) that intercepts the seed phrase during setup. In this regard, former Mt. Gox CEO Mark Karpelès described receiving a device from Malaysia with precisely such a modification. In short, CryptoBilis was sold in March, and according to corporate records, since August 3, 100% of shares have been held by an individual named Jiaming, residing in Heilongjiang Province, China. The new owner, after acquiring CryptoBilis from the previous Malaysian owner, allegedly imposed a non-disclosure agreement preventing the former owner from announcing the sale until October 19. The attached image shows the former owner’s response to a post on CryptoBilis’s X profile, effectively acknowledging that the new management now controls the account and operations—and that he no longer has access. Ledger has requested CryptoBilis to halt all shipments and has warned customers who purchased devices within the last 90 days not to set up their devices—or to transfer funds to a new Ledger device with a new seed phrase. In summary: rather than hacking Ledger directly, this criminal group targeted the weakest link in the official supply chain and planted compromised devices. The investigation is ongoing. Stay vigilant. #crypto #Ledger