If a hardware wallet is purchased from an officially authorized reseller, can users be confident that the device has remained secure from manufacturing to delivery?
The CryptoBilis incident raises this question with potentially significant consequences for cryptocurrency holders.
On October 9, hardware wallet manufacturer Ledger said it was investigating reports of asset losses involving users in Southeast Asia who had purchased devices through CryptoBilis. On-chain investigator Specter estimated that the losses could exceed $86 million across multiple crypto assets, including Bitcoin and Ether. However, that figure has not been independently confirmed.
According to crypto media outlet The Block, CryptoBilis was listed as an official Ledger reseller in Indonesia, Malaysia, and the Philippines. Ledger’s purchasing guidance recommends buying devices through its official store or authorized resellers and completing its Genuine Check verification process during setup.
The incident exposes a critical question about hardware wallet security: If an authorized reseller becomes a potential point of compromise, how much protection do official purchasing channels and device authenticity checks actually provide?
- Authorized Channels Have Their Limits
Purchasing from an official store or authorized reseller is intended to reduce the risk of acquiring counterfeit or compromised hardware. Genuine Check provides an additional layer of protection by verifying the authenticity of the device’s secure chip.
However, neither measure guarantees that a device has remained physically untouched throughout the entire supply chain.
A device could, in principle, pass an authenticity check while containing additional hardware that was installed without the manufacturer’s knowledge. Ledger has also acknowledged that sophisticated supply-chain attacks cannot be ruled out entirely.
Following the CryptoBilis incident, Ledger asked the reseller to suspend sales and shipments. It also advised customers who had purchased devices through the channel within the preceding 90 days to take precautions. Customers who had not yet initialized their devices were advised to pause setup, while those who had already done so were encouraged to consider moving their assets to a new Ledger device and generating an entirely new recovery phrase.
These precautions reflect an important distinction: verifying that a device contains an authentic security component is not the same as verifying the integrity of every component surrounding it.
CryptoBilis had been listed as an official Ledger sales channel, but the entity operating the business subsequently changed. It remains unclear whether Ledger was informed of the ownership transition or whether the reseller’s authorization was reassessed after the change in control.
That uncertainty raises broader questions about how hardware wallet manufacturers vet, monitor, and periodically reassess their distribution partners.
- The Limits of Hardware Authenticity Checks
On October 9, Mark Karpelès, former CEO of Mt. Gox, posted images and teardown findings on X showing a Ledger Nano X suspected of containing implanted surveillance hardware.
The device’s outer packaging appeared intact. However, after the casing was opened, an additional component was reportedly found behind the OLED screen, in a space originally intended for cushioning foam.
According to the published teardown findings, the suspected implant included a microcontroller, a cellular communications module, an antenna, and an eSIM. It was also reportedly connected to the screen’s data lines.
One proposed attack scenario is that the component could monitor information displayed on the screen, recognize a recovery phrase when it appears, and transmit the captured information over a cellular connection.
If such a mechanism were functional, it could provide an attacker with a way to obtain a wallet’s recovery phrase without directly extracting the private key from the secure chip.
However, the distinction between a plausible attack mechanism and a demonstrated compromise is essential. The presence of suspicious hardware does not, by itself, prove that a recovery phrase was successfully captured, that information was transmitted, or that the device was responsible for any reported asset losses. The component’s actual capabilities and the identity of whoever installed it require further verification.
Other Ledger Nano X devices examined by Karpelès reportedly showed differences in the suspected implants, including flexible circuit boards, altered or missing chip markings, and the retention of original battery components. Such variations may complicate visual inspection, but their precise purpose and practical security implications remain uncertain.
On October 10, 23pds, a SlowMist partner and chief information security officer, commented that additional circuitry capable of reading screen data could theoretically capture a recovery phrase and transmit it through an LTE module or eSIM. He also emphasized that the proposed attack sequence remained speculative and required further sample analysis and the results of Ledger’s investigation.
Taken together, these findings highlight an important limitation of device verification.
Ledger’s Genuine Check is designed to verify the authenticity of the device’s security hardware. It is not a comprehensive forensic examination of every physical component. A device may therefore contain an authentic secure chip while also containing unauthorized hardware that the verification process was not designed to detect.
The secure chip can protect private keys and perform transaction signing within the device. But that protection does not automatically extend to every component connected to the device’s display or other interfaces.
If an unauthorized component could read sensitive information displayed on the screen, it could potentially create an alternative route for exposing a recovery phrase, even if the private key itself remained protected within the secure chip.
Crucially, there is currently no established evidence linking the device examined by Karpelès to CryptoBilis or proving that the suspected hardware implants caused the reported losses.
- A Change in Ownership Adds Another Layer of Uncertainty
CryptoBilis’s ownership history has introduced further questions about the company’s operations around the time of the incident.
According to information reported by crypto data platform RootData, former CryptoBilis co-founder Arravind Prabu said the company was acquired in March 2026. Following the acquisition, the original shareholders stepped away from operational, management, and administrative responsibilities.
Prabu subsequently stated on X that contractual confidentiality obligations prevented the former team from publicly announcing the transaction until October 19. He also said that statements published on CryptoBilis’s account after the incident came from the new management rather than the former team.
The period between the reported March acquisition and the October announcement has drawn attention to the company’s governance and ownership transition.
Records cited by RootData reportedly indicate that an individual identified as Jiaming held all of CryptoBilis’s shares from August 3. The underlying registration documents have not been independently reviewed here, and it remains unclear whether the March acquisition and the August shareholding change were separate stages of a transaction or part of a staged closing process.
The ownership transition is relevant to understanding who controlled the business during the period in question. However, it is not evidence that the new shareholder participated in device tampering or cryptocurrency theft.
What has been publicly attributed to the former management is that it had withdrawn from day-to-day operations. Whether the change in control had any direct connection to the security incident remains unresolved.
CryptoBilis also reportedly suspended sales of hardware wallets from all brands and closed its physical stores until further notice. This was described as a suspension initiated by the reseller itself. There have been no reports establishing that devices from other brands were affected.
For now, the ownership timeline provides context rather than proof of causation. Establishing a direct connection would require further evidence about the devices, the distribution process, and the individuals responsible.
- Where Does Security Responsibility End?
Ledger said the asset-loss reports it had received were concentrated among users in Southeast Asia who had purchased devices through CryptoBilis. It also stated that it had not received similar reports from customers who bought directly through its official channels, that its own systems were unaffected, and that its investigation was ongoing.
These statements distinguish the reported incident from a confirmed compromise of Ledger’s broader infrastructure. They do not, however, independently establish how the affected devices were compromised or explain the full extent of the reported losses.
The distinction between official sales channels and authorized resellers is particularly important. Purchasing directly from a manufacturer can reduce dependence on third-party distributors, but it does not eliminate every possible supply-chain risk. Similarly, an authenticity check can verify specific security properties without proving that a device has never been physically modified.
For users, purchasing through trusted channels and following the manufacturer’s verification instructions remain sensible risk-reduction measures. Users should also treat recovery phrases as highly sensitive information and never disclose them to customer support, websites, or individuals claiming to help verify a wallet.
When a reseller becomes the subject of a security investigation, customers should follow the manufacturer’s official guidance rather than assume that an intact package or successful authenticity check settles every concern. If a recovery phrase may have been exposed, simply transferring a device while continuing to use the same phrase will not eliminate the underlying risk; the assets must be secured using a genuinely new recovery phrase.
Ultimately, hardware wallet security depends on more than the authenticity of a single chip. It also depends on manufacturing controls, supply-chain integrity, distribution oversight, device design, and the ability to detect unauthorized modifications.
The CryptoBilis incident raises questions that extend beyond one reseller or one manufacturer. How frequently should authorized distributors be reassessed? What level of physical integrity can device verification realistically establish? And how should responsibility be shared when a product passes its official checks but is later suspected of being compromised?
Once a hardware wallet leaves the factory, who can prove that it has not been tampered with and what should users be able to expect from the brand that stands behind it?