Company
Maker of OneKey hardware wallets for storing crypto private keys offline.
Researcher Joe Grand says he told Ledger of an implanted Nano X on March 4, 219 days before the Oct. 9 CryptoBilis wallet losses. The case that Ledger gave no public warning rests on Grand's criticism and Mark Karpelès saying he has seen none.
Reality
Bitquery estimates $102 million was drained from 324 Ledger-linked wallets on six chains, up from about $86 million earlier. Ledger says its chips, software and servers were not breached and calls it a distribution-channel attack.
Perspective Coverage
6 publishersReality
Ledger disclosed on October 13 that an implant in a signer sold by CryptoBilis captures 24-word recovery phrases and sends them over LTE. Every fund loss Ledger has verified involved devices bought through that reseller.
Perspective Coverage
8 publishersReality
Ledger confirmed on Oct. 10 that one affected customer's wallet held an unauthorized implant, after drains that trackers put near $93 million. That proves tampered hardware reached a victim, but investigators have not tied comparable equipment to the rest of the losses.
Perspective Coverage
22 publishersReality
Researcher @0xJohannes_ says a second Ledger bought at a different MediaMarkt store has the same hidden cables and LTE module as his first. His account does not show where the tampering happened, so the Aqipa link names a supplier and locates no fault.
Reality
OneKey has revoked reseller CryptoBilis and will replace for free every OneKey wallet bought there since March 1. Ledger confirmed an implant in one device from that reseller. Most makers of the other brands it sold have not said whether they are affected.
Perspective Coverage
3 publishersReality