369 Guard

Update · 2026-10-10

Reseller shuts all brands; ~$10M USDT frozen; mixer and exchange hops

10 Oct: CryptoBilis closed stores and online sales for every hardware-wallet brand it sells in Malaysia, the Philippines, and Indonesia (Ledger, Trezor, Tangem, SafePal, OneKey, and others).

It says it is reviewing processes with independent experts and expects more within about three business days. Victims are told to keep the device and packaging and file a police report.

Ledger told Cointelegraph the losses appear isolated to that reseller and market, with no reports from devices bought directly, and that Ledger infrastructure was not compromised.

4M from 471 addresses on seven). Those are address counts, not confirmed victim counts. Tether froze about $10M USDT in thief-linked wallets.

Onchain Lens and Bitquery also report ETH into Tornado Cash, USDT converted toward USDD, a Zcash hop, and about $270K deposited toward Binance.

GoPlus states devices were tampered; that is GoPlus's claim, not Ledger's. Root cause still unconfirmed.

Update · 2026-10-11

Ledger confirms unauthorized hardware implant on an affected device

11 Oct coverage of Ledger's 10 Oct situation update: Ledger says at least one impacted user's device contained an unauthorized hardware implant.

It is contacting affected customers, working with authorities with help from SEAL 911, and inviting tips through its bounty program.

Guidance for CryptoBilis buyers in the past 90 days is firm: do not set up an unused device; if already set up, move funds to a new Ledger with a brand-new recovery phrase.

Ledger repeats that it never asks for your 24 words and that it has no indication its own infrastructure was compromised.

CryptoBilis has paused sales of its entire hardware-wallet inventory until the investigation ends; its promised update is due around 14 to 15 Oct.

Tracer totals are unchanged (~$86M to ~$93M; Ledger has not confirmed a dollar figure). About $10M USDT remains frozen.

MistTrack flagged another ~463 ETH into Tornado Cash on top of earlier mixer counts.

One confirmed implant does not prove every victim device was implanted, and Ledger has not accused CryptoBilis of wrongdoing.

Update · 2026-10-12

72-hour update: limited cases via CryptoBilis; USDC left unfrozen; Tornado tally up

12 Oct coverage of Ledger's 72-hour update (posted 11 Oct UTC): Ledger says the volume of impacted devices is limited (no count published) and that every confirmed case so far involves devices sold through CryptoBilis.

Direct sales and Ledger systems remain unaffected per Ledger. New channel guidance for resellers: source only through authorized channels and never restock returned products.

Buyer advice is unchanged. 1M of Circle-freezable USDC that sat in post-Zcash wallets has fully moved out unfrozen into a busy service-type address; Tether's ~$10M USDT freeze still stands.

6k to 3k ETH. Tracer loss totals are still about $86M to $93M. CryptoBilis' promised update remains due around 14 to 15 Oct.

Separate researcher teardowns of implanted Nano X units from Japanese marketplaces are not linked to CryptoBilis by those researchers.

Update · 2026-10-13

Donjon: implant reads seed off the screen over LTE; trackers past $100M

13 Oct: Ledger's Donjon security team describes the CryptoBilis implant as a hidden board inside the case that reads the 24-word recovery phrase off the display during setup and transmits it over LTE through its own eSIM.

It does not modify the Secure Element, the Ledger OS, or transactions.

Ledger repeats that all confirmed losses from the 09 Oct incident involve devices sold through CryptoBilis, that it has not verified a drain linked to a signer bought elsewhere, and that it has not confirmed victim counts or totals.

Ledger is reviewing reports of implants in other signers and locations, and asks victims not to ship or open a device before speaking with Ledger Support or police. 4M / 530 addresses).

YFarmX also reports a USDD then THORChain path used to step around Tether's freeze. A European buyer reports two implanted units from MediaMarkt stores; Ledger has not confirmed that as a drain.

CryptoBilis has stopped selling Ledger devices.

Update · 2026-10-14

MediaMarkt Saturn paused EU sales; Ledger asks SEA and Hong Kong shelves cleared

14 Oct coverage of Ledger's 13 Oct retail updates: MediaMarkt Saturn stopped sales of Ledger devices in stores and online, with Ledger's alignment, after one customer in Germany reported an implant; The Block says no funds were lost in that case.

Separately, Ledger asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend sales and take products off shelves while the investigation continues.

Ledger still says the only confirmed incidents remain contained to Southeast Asia, that it has not verified a drain linked to a device bought elsewhere, and that it has no indication its infrastructure or direct sales channel were compromised.

Singapore airport and MediaMarkt implant reports remain third-party. Tracker totals unchanged (~$93M to ~$103M).

Peer makers reacted: Trezor removed CryptoBilis; OneKey revoked CryptoBilis and offers free replacements for OneKey devices bought through that reseller from 1 Mar to 13 Oct 2026.

CryptoBilis' promised update was not found as a published post-mortem in this pass.

Update · 2026-10-15

Donjon: German retail and distributor stock showed no tampering

15 Oct coverage of Ledger's 14 Oct Donjon update: Ledger says its team inspected devices from retail and distributor stock across Germany, including units from the stores named online, and none showed any sign of tampering.

Ledger also says no loss of funds related to implants has been reported anywhere in Europe. It has not yet examined the two MediaMarkt units shown online and asks their owner to send them in.

Confirmed drains remain CryptoBilis / Southeast Asia. MediaMarkt Saturn's EU sales pause and the SEA plus Hong Kong shelf pull were still in effect in this pass.

Researchers continue to report implanted units from unauthorized marketplace sellers; Ledger has not confirmed those beyond CryptoBilis.

CEO Pascal Gauthier was due to address the Southeast Asia incident at Ledger Op3n on 15 Oct.

Update · 2026-10-16

Localized distribution attack; back-of-store rules; Chainalysis victim detail; fake firmware phishing

16 Oct: Ledger's 15 Oct blog calls the CryptoBilis case a localized distribution attack, not a systemic supply-chain attack on its chip, OS, or servers.

It says every unit it examined, including German store and warehouse samples, was clean.

New reseller rules: no Ledger products on open shelves or displays; stock kept in the back and handed over at purchase; returned units never resold.

Ledger support on 16 Oct repeated that confirmed incidents remain contained to Southeast Asia. SlowMist warned of a fake Ledger firmware update phishing site with a fake Genuine check.

9M) from three Ledger addresses emptied on 9 Oct; that is a per-victim figure inside the wider tracker range, not a new total.

Ledger told a CryptoBilis buyer it may offer a new device case by case after its own review confirms an implant; do not ship a device until Ledger asks, and report losses to local police first.

Tracker totals remain about $93M–$103M; Ledger has not verified them.

Update · 2026-10-17

Limited number of resellers; Genuine Check cannot see implants; Galaxy ~$91M

17 Oct: Ledger support replies now say all confirmed fund losses in this incident involve devices sold through a limited number of resellers (plural).

Confirmed incidents remain contained to Southeast Asia per Ledger; it has not named a second reseller or verified a drain from devices bought elsewhere.

The same replies point owners to a Ledger self-inspection guide and state that Genuine Check verifies the Secure Element only and cannot detect unauthorized physical modifications such as spying implants.

Galaxy Research puts stolen funds around $91M; other trackers still range up to about $103M. Ledger has verified none of those totals.

Rekt published a Factory Sealed long-read synthesizing prior researcher threads.

Update · 2026-10-18

Ledger reviewing reports outside Southeast Asia; no drain verified there yet

18 Oct: Ledger Support repeats that confirmed fund losses involve devices sold through a limited number of resellers, and adds that it has not verified a drain linked to a device bought outside Southeast Asia while investigations continue and other reports are under review.

Tracker totals stay in the ~$91M to ~$103M range; Ledger has verified none. A public spat between Ledger's CEO and researcher Mark Karpelès adds no new loss figure.

Guidance unchanged: buy direct, follow Ledger's inspection guide if you used a reseller, move funds to a new phrase on a clean device when in doubt. Fake firmware-update phishing remains active.