Ledger had 219 days between a researcher's implant report and the CryptoBilis wallet losses

Trezor has described its own trigger for warning customers, and it gives a yardstick for Ledger's silence. The company told Cointelegraph that counterfeit wallets occasionally appear through unauthorized sellers and that it warned in 2022 about modified devices sold on Russian marketplaces. Its recent claim of no evidence of compromised devices, it said, covered only new wallets sold through authorized resellers ^[9]. "What changes the picture is a new technique, or a first case coming through an authorised channel," Trezor said. "Either one means the problem has moved closer to ordinary buyers, and that's when we'd move fastest, including warning customers directly." ^[10]

Run Ledger's dates through that test. Grand's Nano X came from a Lazada seller called LedgerXXX, which was not listed as an authorized reseller in Thailand when Cointelegraph wrote ^[5]. He reported it to Ledger on March 4 ^[1]. The Oct. 9 losses involved wallets sold through CryptoBilis, a reseller authorized in Southeast Asia ^[3], and that date falls 219 days after Grand's report ^[11]. In our view the charitable reading fits: a lone report from an unauthorized seller is a case file, and a loss through an authorized reseller is a customer notice. We hold it with moderate confidence, because it applies Trezor's rule to Ledger, and the report does not say which channel the December devices came through.

Karpelès, the former CEO of the collapsed exchange Mt. Gox ^[17], concedes that silence on a single case may be normal. "Maybe Ledger not responding to a single event of an implant found on a Ledger purchased from a shady dealer is normal," he said ^[15]. His objection is the count, which he dates back to December 2025, earlier than Grand's March 4 report ^{[12] [1]}. He added: "However the increasing number of reports they must have received, and the increasing quality/technology used should have alerted them enough to act, and at least remind customers to be careful." ^[16]

The charitable reading fails on either of two findings. One is a December 2025 report whose device came through an authorized reseller; Ledger would then have held Trezor's trigger months before the losses. The other is evidence that the implant Ledger confirmed ^[4] did not come through CryptoBilis, because no authorized-channel case would then remain.