Ledger halts sales at Malaysian reseller CryptoBilis while it investigates user losses

Karpelès described an attack that goes around the secure chip. The microcontroller in the unit he photographed was reportedly wired to the SPI bus, the internal line the device's chips use to pass messages, including whatever is sent to the display ^[10]. A new wallet shows its seed phrase on that display when it is initialized ^[5]. Whoever copies the phrase can move the funds, and the owner has no support line to call ^[9]. Crypto Briefing wrote: "The secure chip can do its job perfectly and still lose the fight if someone is reading the screen it talks to." ^[14]

Ledger began investigating after reports of substantial losses among CryptoBilis buyers ^[2]. So far it has ordered the reseller to stop selling and warned that channel's customers ^[3][4]. The warning protects seeds that have not been generated yet ^[5]. A buyer who already set up and funded a CryptoBilis device is outside it. Crypto Briefing's assessment is that the findings point to a reseller problem, not a flaw in Ledger's core product ^[15]. On that view, Ledger's task is policing its distribution. The work of checking where each device came from falls on the people holding them.

The evidence leaves three ways this could go. The first is that the device Karpelès photographed and the CryptoBilis losses are one operation. Crypto Briefing noted that the two disclosures landed on the same day and point to the same region, but said its material does not establish that his unit was sold by CryptoBilis ^[7]. The second is that they are two operations that happen to share a region. The third is that the loss figure moves. Specter, the pseudonymous analyst behind it, counted losses across wallets on Bitcoin, Ethereum and TRON, and nobody has independently confirmed the total ^[12].

I think the supply-chain view holds in all three cases, or rather, the view that the risk sits in the part of the supply chain after a device leaves Ledger. Implant reports in Ledger devices also surfaced earlier in 2026, including cases out of Thailand ^[13]. Add Malaysia and there are at least two Southeast Asian countries where people have claimed tampered units ^[16]. The case against this view is how thin the record is. It rests on one photographed device and an unconfirmed loss count, and nothing yet links the two. Suppose Ledger's investigation traces the CryptoBilis losses to a method that never touched the hardware. Then the channel explanation fails. It also fails if implants turn up in units bought from Ledger directly.

For an operator holding crypto in hardware wallets, the purchase record of each device now belongs in its security file. An added component on the display line is physical hardware, so checking the device's software does not address it ^[10]. The current advice is to buy from Ledger's official channels and to check each device against the company's inspection guidance ^[8].