Ledger warns CryptoBilis buyers after wallet tampering
Ledger has warned customers who bought hardware wallets through Southeast Asian reseller CryptoBilis to stop using them. The confirmed cases involved devices sold by CryptoBilis, with investigators linking the incident to estimated losses of $86 million to $93 million across hundreds of wallets. Bitcoin, Ethereum and TRON wallets were affected, though the final loss total and number of compromised devices remain uncertain.
Investigators, including SlowMist, suspect an unauthorized hardware module captured recovery phrases during setup. Ledger confirmed at least one affected device contained an unauthorized LTE-enabled microcontroller with eSIM capability; suspected models include the Nano X and Flex. CryptoBilis, which operates in Indonesia, Malaysia and the Philippines, has suspended hardware-wallet sales. Ledger says its own systems and official direct-sales channels were not affected and that it is working with law enforcement.
Ledger advises customers with unused devices to leave them uninitialized. Anyone who has already set up or used a CryptoBilis device should move funds to a new wallet on hardware obtained through an official channel, using a newly generated recovery phrase. Users should never share their 24-word recovery phrase, including in response to unsolicited calls or messages.
Neutral
The incident is serious for affected wallet holders, but its direct price impact on BTC, ETH and TRX is likely limited. The reported losses stem from compromised hardware-wallet devices sold through one reseller, rather than a weakness in the underlying blockchains or a failure of Ledger’s official sales infrastructure. That makes broad, sustained selling in the three assets less likely, although headlines and concern about wallet security could prompt short-term volatility or risk reduction among some traders.
In the near term, the estimated $86 million to $93 million in losses and uncertainty over the number of compromised devices may weigh on sentiment, particularly if additional victims or losses emerge. The assets involved could also face temporary selling pressure as affected users move funds or liquidate holdings, but the summaries do not establish that such selling has occurred. Over the longer term, the event may increase scrutiny of hardware-wallet supply chains and encourage users to adopt safer purchasing and recovery-phrase practices. Unless the investigation reveals wider compromise or broader market contagion, the incident alone is not a clear directional signal for BTC, ETH or TRX prices.