Reports about wallet-draining by Ledger users. Total losses $86M+

[stompix]

The attack's victims extend beyond the 90-day window mentioned by Ledger. This directly points to devices purchased previously or existing seed phrases restored on newer devices.

That was a dumb take from Ledger anyhow, what was a 90-day period supposed to mean?
Unless they had a list of clients and they somehow managed to match all complaints with a batch of products, this was just dumb.

.. could North Korea be behind this?

The chances are not zero.

Yeah, not zero, but more likely 0.0001%
While I doubt it's the case, there is one country that has a history of tampering with so-called secure devices, establishing a reseller company, and then blowing terrorist disks off!
If this had been a Middle East reseller, you could have started pointing fingers, but this is not in their interest at all.

Back to the drain, there are going to be some sad stories these days
The guy who owns those addresses, bc1qhwwe564ptmn5yjjl3u4anc0h2r052l3xn4ndy9, bc1qn7cgqfee6e3d0qgpyac8d6zq9t4yf80qkpsure they both have the same funding address and same time on previous txs is going to wake up in a nightmare, he has been acquiring coins in those since 2021 and 2022!

[DireWolfM14]

While I doubt it's the case, there is one country that has a history of tampering with so-called secure devices, establishing a reseller company, and then blowing terrorist disks off!

One man's terrorist is another man's freedom fighter.  

If this had been a Middle East reseller, you could have started pointing fingers, but this is not in their interest at all.

That would be an interesting twist.  If you're talking about the "Middle Eastern" country (made up of Europeans,) then again, the chances are still not zero.  Money is definitely within the scope of their interests.  Maybe all the scope of their interests.

Back to the drain, there are going to be some sad stories these days
The guy who owns those addresses, bc1qhwwe564ptmn5yjjl3u4anc0h2r052l3xn4ndy9, bc1qn7cgqfee6e3d0qgpyac8d6zq9t4yf80qkpsure they both have the same funding address and same time on previous txs is going to wake up in a nightmare, he has been acquiring coins in those since 2021 and 2022!

This makes me think it has to be a CryptoBill's supply chain attack, and that they've been planning this for quite some time.  The odds of so many people with years of bitcoin experience falling for a phishing email seem to be shrinking.

[greysonz]

This thing probably listened to what phrase the user would make and sent it over the Internet.

I believe that this technical version with the spy chip will turn out to be true:

small board hidden inside a genuine Ledger Nano X listens to the wire between the secure element and the screen. When the wallet shows its 24 recovery words, the implant reads them pixel by pixel, recognises the letters, and sends them out over the cellular network. The secure element is never attacked, and the device works normally. In about a year the implant has gone from a bundle of hand-soldered wires to a board that is painted to match, has its chip markings sanded off, and leaves the battery alone.

https://www.tibane.net/research/ledger-nano-x-implant

[promise444c5]

No, no... definitely no. Ledger's don't come with a pre-generated seed. They come with blank cards to write the random seed in. And I always tell people to wipe out the wallet after it gives you a seed and force it to give you another one, just to prove it's giving you random seeds.

Yeah.. thought as much, no sane wallet should have a pre-generated seed.

julerz12 eventually cleared that  the confusion was from their end.

By the way, Ledger has been getting burned and burned been a while, has it's reputation already burnt to ashes or any remaining?

I think people who own or about to own are still living in caves or just don’t care about the reputation, but at the end, everyone is responsible for the decisions made on handling their funds.. they are free to choose, how they hold and do whatever they want with their bitcoin and other crypto assets.

[blockman]

OMG, this shop was supposed to be my choice when I am trying to contact them last year for some inquiries when I'm thinking of buying an extra hardware[they also sell other hardware]. But they're not responsive at all, they have the discount for all hardware on their website. My purchase didn't happen. I thought they're a local company originated here because 'bilis' means 'fast' in our local language.

The real lesson for this Ledger attack is, don't buy hardware wallets from a third party, ever. That's a painful truth. I've been recommending people buy hardware wallets at physical stores instead of by mail. Now, I don't think I can recommend that at all.

It's a shop that's part of the list of official reseller of Ledger's, and can't blame the victims too. But just like you, I won't be recommending any reseller anymore.

[stompix]

One man's terrorist is another man's freedom fighter.  

That would be an interesting twist.  If you're talking about the "Middle Eastern" country (made up of Europeans,)

You're so easy to bait it's embarrassing!

By the way, Ledger has been getting burned and burned been a while, has it's reputation already burnt to ashes or any remaining?

I think people who own or about to own are still living in caves or just don’t care about the reputation, but at the end, everyone is responsible for the decisions made on handling their funds.. they are free to choose, how they hold and do whatever they want with their bitcoin and other crypto assets.

Willing to bet they are going to have a black friday sale again with record numbers?
The way they keep getting away with stuff is incredible. I mean, we add our addresses and phone numbers, leaked and most advices you would hear were to send the package to PO box or  pick-up address, now probably a lot will say just open the device, look at the original schematic, desold any components that are not on the list, pack it back up and use it, it's safe!!!!  

[rdluffy]

I think this is already the fourth time in a short while that I’ve seen a news and immediately had a “mini heart attack and panic attack” just from reading the words “Ledger,” “hardware wallet,” “hack,” “exploit,” “theft,” etc  

I rushed to check my Ledger Wallet on my PC, and everything is okay
Then I started reading here to understand what happened

I’ve never felt comfortable or safe buying from resellers (I’m from Brazil, and here there are only one or two resellers, all online
I believe that in a few hours we'll find out that this amount will increase,  unfortunately, not all owners of these ledgers will find out in time

[promise444c5]

Willing to bet they are going to have a black friday sale again with record numbers?

Nah.. I’m good  .

I guess some are just considering the money spent on getting those hardware wallets..

But it’s sad to know that someone could still have their 80 Bitcoins if they had never thought of giving Ledger wallet a chance.

Some lessons aren’t meant or should I say they shouldn’t be learned the hard way.

I rushed to check my Ledger Wallet on my PC, and everything is okay
Then I started reading here to understand what happened

I know you’re not a caveman.. so I believe you know what you’re doing  

[PX-Z]

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis...https://x.com/Ledger_Support/status/2108551100613714002?s=20

This damn crazy. I know this store as well, and many recommends buying it there since its much more near on my area.
If you bought your device directly from Ledger (France) your personal info will get compromised, if you bought ledger on its resellers, your funds lots. You have no escape lmao

[dkbit98]

Just when you thought ledger can't sink any further...and something like this happens
Resellers are harder to control and they are certainly adding additional risk if they are infiltrated by bad actors.
As for ledger, there is basically no good way to buy their devices, and nobody should waste money on that crap.
Anyone who is still trusting the whole ledger ecosystem has very low IQ.

[X-ray]

I know some folks would still ignore this as if CryptoBillis CryptoBilis isn’t an authorized reseller.

Infact, Ledger force people to buy from their local resellers like CryptoBillis CryptoBilis if ledger can’t ship directly to their location, which is more like saying “we have a store closer to you , go grab your Ledger wallet there”. Yet , when addressing the issue they never mentioned “our authorized reseller CryptoBillis” all they mentioned was “a reseller named CryptoBillis”  .

Ledger should also be responsible then, calling authorized reseller which got listed in their site as just a reseller, sounds like an attempt to secure legal standing and mitigate liability before things went into shit.

It still bother me why certain hardware wallet company operate like a damn indiegogo startup selling through a reseller.

Aren't we living in 2026 and every shipping company able to ship everywhere and the barrier is only shipping fee?

I would never gonna use any hardware wallet sent from reseller, either it's sent from the manufacturer directly or im not buying that shit.

[joker_josue]

Just when you thought ledger can't sink any further...and something like this happens
Resellers are harder to control and they are certainly adding additional risk if they are infiltrated by bad actors.
As for ledger, there is basically no good way to buy their devices, and nobody should waste money on that crap.
Anyone who is still trusting the whole ledger ecosystem has very low IQ.

I think we all need to rethink our wallet setup for storing our bitcoins.

That's because, through this approach, we might get news of something similar coming from other devices that people have been buying.

It's about reviving "old techniques" that, despite seeming simple, are the safest.

Personally, I've been looking at SeedSigner as a viable option.

[GreatArkansas]

I was able to purchase my hardware wallet from this reseller in 2021 here in the Philippines: https://bitcointalk.org/index.php?topic=5596400.0
This store is famous on one of the e-commerce sites here and has a lot of reviews.

Most victims are, like, recently- more or less 1 year ago- and I checked my hardware wallet; all good, no transactions happened recently. But I am still worried.

This store on a famous e-commerce site is still active right now in the Philippines; I already reported it and am asking some of my fellow countrymen to do it too;

[Meuserna]

I was able to purchase my hardware wallet from this reseller in 2021 here in the Philippines: https://bitcointalk.org/index.php?topic=5596400.0
This store is famous on one of the e-commerce sites here and has a lot of reviews.

Most victims are, like, recently- more or less 1 year ago- and I checked my hardware wallet; all good, no transactions happened recently. But I am still worried.

Here's what I would do if I were you. It's what I did when I stoped trusting Ledger:

Create a text document with multiple columns. 5 or 6. Copy the entire BIP39 wordlist and paste it into that doc. The reason you want columns is, you want as many words as you can get on each page, in easy to cut lines... because you're going to use scissors to cut 'em apart.

Print the text doc (it'll be multiple pages) and cut it up so each word is on a separate slip of paper.

Dump the slips of paper in a bowl. Shuffle them!!! Pick 23. Write 'em down.

Get a new hardware wallet. Enter those 23 words and let the hardware wallet calculate the 24th word for you (the checksum). Do this and you'll know your seed is safe, because you made it yourself 100% randomly.

[taufik123]

Former Mt. Gox CEO Mark Karpelès believes the cause may be a malicious implant. A physical cause.

This looks like this could be exactly what I'm investigating. Anyone affected, please contact me or open your ledger and send me pictures so we can confirm if there's a bug in there (pictures: ledger board on top, spy implant below).

https://x.com/MagicalTux/status/2108556423445835827

It is a kind of implant that is implanted deliberately, like a Skimming tool to find out the ATM password. On the Ledger, the skimming device only reads the text on the screen.
A scammer's clever way of utilizing Resellers to trap all users.
Nothing is safe at the moment, too much hacking and manipulation.

[julerz12]

I was able to purchase my hardware wallet from this reseller in 2021 here in the Philippines: https://bitcointalk.org/index.php?topic=5596400.0
This store is famous on one of the e-commerce sites here and has a lot of reviews.

Most victims are, like, recently- more or less 1 year ago- and I checked my hardware wallet; all good, no transactions happened recently. But I am still worried.

I just checked it today, and their shop on that app/site is no longer available (it was still there last night), either they explicitly removed it (due to Ledger's request) or it really got reported. Just to be safe, better to move your funds for now. We still don't know how long this reseller has been tampering these devices as other user have pointed out, some wallets that are funded months before the "management change" still got drained.

[Rashlyowl]

I just checked it today, and their shop on that app/site is no longer available (it was still there last night), either they explicitly removed it (due to Ledger's request) or it really got reported. Just to be safe, better to move your funds for now. We still don't know how long this reseller has been tampering these devices as other user have pointed out, some wallets that are funded months before the "management change" still got drained.

According to the official statement, the acquisition took place in March 2026:

1. Operational Handover & Conclusion of Role:
Earlier this year, CryptoBilis was acquired by new ownership. As part of this transition, Vimal and I officially stepped down and completed a full handover of all operational, managerial, and administrative responsibilities in March 2026.

I don't know whether my assumption is correct or not, but I believe that prior to the full acquisition, the acquiring party had already carried out a soft transition, securing roles in key areas before the acquisition was fully finalized. That is why the address funded two months prior to the acquisition was still drained.

If we happen to have an address that gets drained sometime between the first & third quarters of 2025, we could conclude that Cryptobilis is truly disreputable.

[notocactus]

There is a very old guide, and now it's time to summon it back here
Check Integrity of Hardware Wallets.

Clearly an official reseller store with this scam is very scary.
[GUIDE] How to buy a Hardware Wallet the right way.

Not all people can check hardware wallet integrity so this scam is actually a big bomb in Bitcoin community. "Don't trust, verify" is quite common reminder but I think it's too technical for Bitcoin users especially newbies to do all verification before they starting with purchase and storage.

Perhaps Bitcoin Spot ETFs and centralized exchanges will have advantage this time. Anyway there is a Reminder: do not keep your money in online accounts.

[pooya87]

Just another reason to justify my long dislike of hardware wallets!

Dump the slips of paper in a bowl. Shuffle them!!! Pick 23. Write 'em down.

Get a new hardware wallet. Enter those 23 words and let the hardware wallet calculate the 24th word for you (the checksum). Do this and you'll know your seed is safe, because you made it yourself 100% randomly.

Just remember to put the word back in the bowl to avoid bias and since words can be repeated. And remember it won't solve the issue with a compromised device that is broadcasting the seed phrase to a remote server!

[Meuserna]

Just another reason to justify my long dislike of hardware wallets!

Dump the slips of paper in a bowl. Shuffle them!!! Pick 23. Write 'em down.

Get a new hardware wallet. Enter those 23 words and let the hardware wallet calculate the 24th word for you (the checksum). Do this and you'll know your seed is safe, because you made it yourself 100% randomly.

Just remember to put the word back in the bowl to avoid bias and since words can be repeated. And remember it won't solve the issue with a compromised device that is broadcasting the seed phrase to a remote server!

Yeah, I simplified the steps a bit for a quick comment here. I also swear by using an airgapped and stateless device like SeedSigner (or, better yet, ShieldSigner, Krux, or Kern).