What Happened at CryptoBilis

On October 9, wallets belonging to customers of CryptoBilis started draining simultaneously on several blockchains. People lost tens of thousands, hundreds of thousands, even millions of dollars in Bitcoin, USDT, ETH and other assets. The common point: they had all bought a Ledger from CryptoBilis.

CryptoBilis was an authorized Ledger reseller, with physical stores and an online shop in Malaysia, Indonesia and the Philippines. It was not some dubious seller on Lazada, AliExpress or Temu. By October 10, Ledger confirmed that at least one affected device contained a hardware implant — a component inside. On-chain analyses later suggested at least $103 million had been drained, although early estimates were between $83 and $86 million.

Ledger opened an investigation and asked CryptoBilis to stop selling. The reseller complied, stopped selling all hardware wallets from any brand, and closed its stores. At that point, no one was designated as the culprit. Ledger's own systems were not compromised, and this was not a flaw in their code or hardware design. This week, MediaMarkt in Germany also pulled Ledgers from its shelves as a precaution after someone reported a similar issue.

How the Hidden Implant Works

The implant intercepts the 24 words as they travel from the device to the screen. It has a small chip, an eSIM and an LTE transmitter that sends SMS messages to the hackers. That is why it passes Ledger's own authenticity check: it does not break any security. It simply reads the words as they pass through the motherboard on their way to the display, like someone standing behind you reading your screen.

It is the same principle as skimmers on ATMs. The ATM is genuine, but a malicious reader sits between your card and the machine. Here, the implant sits between the chip and the screen. No security is cracked; the data just passes through a compromised path.

What impressed me most is the miniaturization. The Ledger case has very little room inside, so attackers remove the foam reinforcement or even reduce the battery size to keep the device weight identical. That way, weighing the device does not help. Some people shared photos online showing these implants. It is very sophisticated work.

In my research, the trail points toward a Chinese or North Korean operation. Six months before the incident, CryptoBilis was bought by someone from northern China, close to the North Korean border, who took control of the supply chain. That is why this is called a supply chain attack.

Why a New Wallet Won't Save You

Many people's first reflex is to buy a new Ledger or switch to another wallet. But if you reuse the same seed phrase, you are giving the thief exactly the same access. The 24 words have already been read. Moving them to a new hardware wallet is like moving to a new house but keeping the same lock.

When I saw the news at Token 2049 in Singapore, I immediately messaged friends who use Ledger: 'Be careful. If you are worried, temporarily move funds to a new address until we understand what is happening.'

If you think your device may be affected, create a brand new seed phrase and move your funds to a new address derived from it. Not just a new wallet, a new address with new words.

Practical Checks for Your Cold Wallet

You can reduce risk with basic checks. Buy directly from the manufacturer or a trusted source. Avoid secondhand marketplaces like eBay or Leboncoin. Check the packaging for tampering. Run Ledger's genuine check, but remember it is not sufficient because the implant can still pass it. Make sure the device generates the seed phrase itself — you should never type it anywhere, not on a computer, phone, website or cloud. If the box already contains a pre-printed phrase, that is a red flag.

Weighing the device or checking the battery is not enough, because attackers can adjust those. In my opinion, opening the device and inspecting the inside is the best thing to do. If you have any doubt, consider multisig or multi-vendor setups, though that is more technical.

Ledger has published an official response and analysis. This time, Ledger is not to blame: the devices were modified in the distribution chain. No vulnerability affecting all Ledgers has been established.

  • Buy only from the manufacturer or authorized resellers you trust.
  • Never type your seed phrase on any device except the hardware wallet itself.
  • Open the device and look for unexpected components or missing foam.
  • If in doubt, move funds to a brand new address with a brand new seed phrase.

Self-Custody Is Still the Right Path

I remain convinced of the value of self-custody. But buying a cold wallet is not enough. You need to understand what actually protects your money. This attack did not break Ledger's cryptography; it attacked the supply chain. Even the best hardware wallet can be tampered with before it reaches you.

Security is a process, not just a product. Check your device, generate your seed phrase properly, and never share your 24 words with anyone, even if they claim to be support.

Stay Vigilant, Stay Sovereign

The CryptoBilis case is a wake-up call, not a reason to abandon self-custody. Cold wallets still do what they promise, but only if the device you receive is intact. A supply chain attack can hit any brand, which is why physical inspection and careful sourcing matter as much as cryptographic security.

The most important lesson is about seed phrases. If your 24 words have been exposed, nothing else matters until you generate a new set. Move your funds to a new address with new words, and take the time to learn how your wallet works. That is the real protection.