CryptoBilis Supply Chain Theft and Industry Response

1. 04:55
   Cryptopolitan

   Task scam operator loses approximately 60 Bitcoins and $4.8 million in Ledger hardware wallet implant attack

   A task scam operator lost approximately 60 Bitcoins (about $4.8 million) in a Ledger hardware wallet implant attack, after the stolen funds had previously been transferred to three Ledger wallets. Ledger said criminals hid implants in genuine devices and distributed them through Southeast Asian channels, stealing 24-word recovery phrases during installation.

2. 00:08
   Cryptopolitan

   Ledger announces tamper-resistant hardware wallet Atom, launching as early as summer 2027

   In response to an incident in which hardware implants led to customers losing approximately $86 million in funds, Ledger announced the tamper-resistant hardware wallet Atom, launching as early as summer 2027 at a price of $849. Atom will protect the Secure Element, MCU and FPGA in monitored areas, and use the Core Protection feature to block screen-reading implants; existing Nano, Flex and Stax devices will not receive these protections.

1. 04:55
   Cryptopolitan

   Trezor will stop supplying certain distributors and revoke their authorization starting January 1, 2027

   Starting January 1, 2027, Trezor will stop supplying and revoke the authorization of certain unnamed distributors in response to the CryptoBilis wallet supply chain incident. Ledger Donjon found unauthorized chips in the affected wallets that could record the 24-word recovery phrase displayed during initialization and transmit it via LTE and a provisioned eSIM.

1. 21:44
   Cryptopolitan

   Ledger discloses that hidden chips in CryptoBilis hardware wallets stole recovery phrases

   Ledger disclosed that some hardware wallets sold by CryptoBilis contained an extra chip that could read 24-word recovery phrases from the screen and transmit them to attackers via an integrated SIM card and LTE.

2. 17:33
   Cryptopolitan

   MediaMarkt records point a second suspected tampered Ledger hardware wallet to distributor Aqipa

   Crypto researcher @0xJohannes_ said he found a second suspected tampered Ledger hardware wallet at another MediaMarkt store, with in-store records showing that the inventory came from Aqipa GmbH. Like the previous device, it was found to have an added cable and a concealed LTE module, and will now be sent to Ledger for analysis; Aqipa has distributed Ledger devices in Germany and Austria since 2023. Ledger said its systems and direct sales channels were not compromised, and that all confirmed cases were linked to CryptoBilis.

3. 17:27
   CoinDesk

   Ledger says some CryptoBilis hardware wallets were implanted with chips and used LTE to steal recovery phrases

   Ledger said some hardware wallets sold by CryptoBilis were implanted with chips that read the 24-word recovery phrase displayed on the screen and transmitted it to attackers via LTE. Ledger said this constituted a physical supply chain attack and did not affect its software, internal systems, Secure Element, or transaction signing process; on-chain researchers estimated that more than 300 wallets lost up to $93.2 million.

1. 23:16
   Cryptopolitan

   Tether freezes $10 million USDT linked to the Ledger hardware wallet theft involving devices sold by CryptoBilis

   Tether has frozen $10 million USDT linked to the Ledger hardware wallet theft involving devices sold by CryptoBilis; Bitquery estimates that the attack transferred $93.2 million in assets from 315 wallets, mainly involving USDT and TRON. Ledger said it confirmed that all reported cases involved the third-party seller, which operates in Malaysia, Indonesia, and the Philippines, and found that one device had been implanted with unauthorized physical components; CryptoBilis has suspended sales and deliveries and closed its physical stores in the three countries.

2. 20:03
   Cryptopolitan

   Ledger confirms CryptoBilis implant; other wallet buyers seek answers
3. 20:01
   CoinDesk

   Ledger says CryptoBilis incident had limited impact: up to $93 million in funds tracked, $10 million frozen

   Ledger said the incident was limited to the affected devices sold by authorized distributor CryptoBilis; blockchain analytics firms tracked up to $93.2 million in stolen crypto assets, and Tether has frozen $10 million in USDT. Ledger confirmed that at least one device contained an unauthorized hardware implant and advised users not to activate unused devices. Users who had activated them should transfer their assets to new devices using newly generated recovery phrases.

4. 15:49
   CoinDesk

   Ledger confirms at least one device sold by CryptoBilis contained an unauthorized hardware implant

   Ledger confirmed that a device sold by Southeast Asian distributor CryptoBilis and linked to a recent crypto asset theft incident contained an unauthorized hardware implant. On-chain researchers estimated that more than 300 wallets lost $86 million to $93 million, but Ledger said its internal systems and direct sales channels were not affected. Ledger advised CryptoBilis customers not to initialize unused devices; wallets that have been enabled should use a new device obtained directly from Ledger to generate a new seed and migrate funds.

1. 05:08
   Cryptopolitan

   Suspected hacker targeting Ledger distributor CryptoBilis transfers nearly $1.3M to Tornado Cash and Binance

   A suspected hacker targeting customers of Ledger wallet distributor CryptoBilis transferred 430.2 ETH worth approximately $1.07 million to Tornado Cash through four wallets, and another $270,280 to Binance.

2. 02:30
   Cryptopolitan

   Ledger investigates $86M crypto asset theft linked to its listed reseller

   Ledger has launched an investigation into the theft of over $86 million in Bitcoin, Ethereum, and Tron from wallets sold through the Malaysian online store CryptoBilis.

Current heat 3·Peak over the comparable range 20 (Oct 13 18:00)·Change over the comparable range in the last 24 hours -49%

Trends compare only the same entities that were fully and continuously observed, so the range can be narrower than the current heat statistics. Move the pointer or tap the chart to read hourly heat; arrow keys work on a keyboard.