The Tampered Device: Inside the CryptoBilis Case and What It Proves About Self-Custody

On October 9, Ledger said it was investigating reports of lost funds from customers who had bought its hardware wallets through CryptoBilis, a reseller based in Kuala Lumpur and authorised for Indonesia, Malaysia and the Philippines. Within hours, on-chain researchers were publishing suspected theft addresses and figures that ran past $86 million. The next day, Ledger confirmed the fact that turned a wave of complaints into a case: one affected user's device contained an unauthorized hardware implant.

That single sentence is the centre of this deep dive. It is narrower than the numbers circulating around it and more consequential than any of them, because it describes a failure that no amount of careful key handling by the owner can prevent — a device that was compromised before it ever reached the person who trusted it. What follows separates the confirmed from the estimated, explains the mechanics that make a tampered display so effective, and sets out what to do differently.

Every figure here is dated and attributed. Where Ledger has confirmed something, we say so; where analysts have estimated it, we say that instead.

1. The Incident in Six Lines

• October 9: Ledger says it is investigating reports of lost funds from Southeast Asian buyers of reseller CryptoBilis, asks the reseller to pause all sales and shipments, and tells buyers within 90 days not to initialize their devices — and, if they already have, to move assets to a new device with a newly generated phrase.
• October 10: Ledger confirms that one affected user's device contained an unauthorized hardware implant. CryptoBilis halts sales of its entire hardware-wallet inventory.
• The mechanism, as described by researchers: additional circuitry near the device's display, positioned to read the recovery phrase as it appears on screen during setup, with some examined units including cellular hardware to transmit what they captured.
• What Ledger has confirmed: the implant in one device, and that it has no indication its own security infrastructure, systems or services were compromised.
• What Ledger has not confirmed: any loss amount, any affected-device count, and any causal link between the implant and the reported drains.
• The estimates: analysts trace suspected losses above $72M and above $86M on different address sets, with one analytics firm at about $92.9M across 311 wallets. Tether has frozen roughly $10M in USDT linked to the activity.

2. Three Numbers, Three Answers: Why the Loss Estimate Is a Range and Not a Figure

The figures circulating for this case do not agree, and the disagreement is informative rather than embarrassing. Offering more than $86M was researcher Specter, who traced inflows from hundreds of victim wallets across Ethereum, TRON and Bitcoin to ten addresses. Researcher tanuki42 listed eight of those addresses and put the total above $72M, and the analytics firm Bitquery estimated about $92.9M across 311 wallets on six chains, while a separate firm, YFarmX, put suspected losses near $94.5M across 521 sending addresses. Arkham grouped 152 addresses under a 'ledger-drainer' label valued at roughly $71.6M at one point. Every one of these is a number derived from public blockchain data by a different method — different address sets, different cut-off times, different treatments of funds already moved — and none has been confirmed by Ledger.

That is why this deep dive does not collapse them into a single headline. Three things are true at once: the suspected losses are in the tens of millions of dollars by every estimate; the exact figure depends on which addresses and which moment you count; and the number a reader should anchor on is not any of these but the absence at the centre of them — Ledger has confirmed no loss total at all. When a vendor has confirmed the method and not the amount, the honest reading is that the amount is unknown, not that it is $86M.

3. Timeline

The case compressed into about thirty-six hours from first public report to physical confirmation, which is why the details moved faster than the understanding.

4. Where It Broke: The Display, Not the Secure Element

A hardware wallet is built around a secure element — a hardened chip that holds the private keys and is designed so that the keys cannot be extracted even by someone with physical possession. The attacks described in this case do not defeat that chip. They route around it, through the one moment when the secret is deliberately made visible: setup, when the device generates a recovery phrase and displays it on its screen for the owner to write down.

The display talks to the device's processor over a serial interface, and the researchers examining units from this case describe additional components placed near that connection — a microcontroller, and in some examined units cellular hardware, an antenna and an embedded SIM. A component listening on the display link can reconstruct the characters shown during initialization and store the words; the cellular hardware can then send them out. The result is a wallet whose cryptography is intact and whose phrase is already known to someone else, which is the worst of both worlds: the owner sees a device that passes its authenticity checks and behaves normally, and the attacker holds the master key.

This is why Ledger's own guidance did not stop at 'return the device.' It distinguished between buyers who had not set their device up — told to leave it uninitialized — and buyers who already had, who were told to move assets to a new device with a newly generated recovery phrase. The distinction is the whole point: if a phrase may have been captured at setup, restoring that same phrase onto new hardware changes nothing, because the exposure travels with the words, not with the device. Two other details matter for anyone trying to gauge their own exposure. Ledger has said it has no indication its own infrastructure, systems or services were compromised, pointing instead at the reseller's channel, and its documented Genuine Check verifies the chip and firmware — effective against counterfeits, but not designed to detect physical modification while the original chip remains intact. A device can therefore be genuine and tampered at the same time.

5. Who Paid, and How Much

The affected customers are concentrated in Indonesia, Malaysia and the Philippines — the markets CryptoBilis serves — and the reported cases show the profile of users who did everything the industry tells them to do and still lost everything. On-chain analysts highlighted a Bitcoin address that received 80 BTC about ten days before the funds were swept out in a single transaction on the morning of October 9; the owner had bought the coins four months earlier near $65,000 and moved them onto a device bought a week before the sweep. Another case involved a TRON wallet holding about 7M USDT, drained in the first wave after its owner bought a device from the same reseller three weeks earlier. A third involved 59 ETH moved from a long-dormant wallet to a newly activated one and then lost.

The asset mix explains why TRON features so heavily in a story about hardware: the value was concentrated in USDT, and TRON carries the majority of USDT's global volume, so it is where large stablecoin balances naturally sit. The chain is not the vulnerability any more than the vault is — the point is that whoever held the phrase could move the balance on whatever chain it was on. Tether's freeze of roughly $10M in USDT is the one recovery-side figure a regulated issuer has confirmed; investigators say some of the remaining funds have already passed through mixers.

6. The Same Week, One Layer Out

The CryptoBilis case did not arrive alone, and reading it beside the week's other incidents sharpens what it means. On October 6, a five-year-old MakerDAO auction keeper was drained of 200 ETH through a single function that could be called without authentication — old code, holding value, still reachable. On October 7, a trader's wallets were swept for about $4M at a conference. And a month earlier, a firmware flaw in a different hardware wallet, Coldcard, was linked to the loss of roughly 1,816 BTC, about $116M. Three different layers, one recurring question: what did the user, or the protocol, assume was verified?

The hardware cases make the point most cleanly because the assumption is so reasonable. Buying from an authorised reseller, checking that a device is genuine, generating and storing the phrase offline — that is the recommended procedure, executed correctly, and it still failed for the buyers caught in this case because the device was compromised before any of those steps could matter. That is not an argument against hardware wallets. It is a precise statement of where their guarantee actually begins: at the factory, or at the reseller, or at the moment you open the box, and each of those hands the device on to the next with a promise the next cannot verify. The only step in that chain a buyer fully controls is the one where the phrase is generated — which is why it has to be generated on the device, by the buyer, and never accepted from anyone else.

7. What to Do With This

For the specific case, Ledger's guidance is the operative advice and it is narrow: if you bought from CryptoBilis in the last 90 days, do not set the device up if you have not; if you have, generate a new phrase on a trusted device and move the balances on-chain, and do not restore the old phrase onto new hardware. For everyone else, the case distils into four habits that apply to any hardware wallet and any reseller:

• Buy from the manufacturer directly where you can, and treat reseller savings as carrying a supply-chain risk that no receipt or warranty discharges.
• Initialize the device yourself and generate your own recovery phrase. A device that arrives already set up, or with a phrase printed on a card in the box, is disqualified regardless of how it looks — the seller would know the words.
• Understand that vendor authenticity checks verify the chip and firmware, not the physical integrity of the whole device. Passing a genuine-check does not mean no one opened it.
• If a phrase may ever have been exposed — captured, typed into software, or generated on a device you did not initialize — generate a brand-new phrase on trusted hardware and move the assets, then revoke approvals on the old address. A new device with the old phrase fixes nothing.

8. What to Watch

Ledger has said it is contacting affected users, working with authorities, cooperating with the SEAL 911 incident-response group and running a bounty channel, and that CryptoBilis has stopped selling its hardware inventory until the investigation concludes. It has published no affected-device count, no loss figure and no timeline, so the three questions that would settle the case — how many devices were modified, how the implant entered the supply chain, and whether it caused the reported drains — remain open. Former CryptoBilis executives have said they completed a management handover in March after an ownership change, a statement that establishes neither who modified a device nor any connection to the incident.

Two cautions for the coming weeks. First, incidents of this profile reliably breed follow-on fraud: fake 'device recall', 'verify your wallet' and 'security refund' messages impersonating the vendor are the predictable next wave, and the response is the standing rule — Ledger, or any vendor, will never ask for your 24 words, and updates come from official channels only. Second, the parallel Coldcard case is not resolved either, and two hardware-wallet incidents in a short stretch is the kind of pattern that should move 'prove the device, then use it' from advice to procedure. The category is not broken. The assumption that the box arrives trustworthy is.

Disclaimer: This content is for informational purposes only and does not constitute financial, legal or security advice. No checklist or tool eliminates risk entirely; self-custody means you are responsible for your own keys.