Ledger says the number of devices affected by the CryptoBilis incident remains limited, even as a security researcher reports finding a potentially tampered hardware wallet purchased in Europe. The company’s October 11 update said all confirmed cases linked to the October 9 draining incident involved devices sold through the Southeast Asian reseller, while its own systems and direct sales channels remained unaffected.
The European report raises questions about whether similar hardware modifications may exist outside the confirmed incident. However, Ledger has not confirmed that the reported European device is connected to the CryptoBilis investigation, and the device’s reported condition does not establish how many other units may be affected.
The investigation has also drawn attention to CryptoBilis’ ownership history. Binance co-founder Changpeng “CZ” Zhao claimed that the attackers had apparently bought the reseller and made its owners sign a non-disclosure agreement. Separate posts on social media say the business changed ownership earlier in 2026, but no evidence cited so far establishes that the buyer was involved in the device tampering.
Ledger Says Confirmed Cases Remain Linked to CryptoBilis
In its 72-hour update on the CryptoBilis incident, Ledger said the volume of impacted devices was limited and that all confirmed cases involving the October 9 draining incident related to devices sold through CryptoBilis.
The company also reiterated that its systems and direct sales channels remained unaffected. Ledger has not yet published a precise count of affected devices or confirmed the total value of cryptocurrency lost in the incident.
The update reminded authorized resellers and distributors to source products through authorized channels and not to restock returned products. Ledger also advised users against buying from unauthorized resellers and said it was working with relevant authorities. It thanked the security-response collective SEAL 911 for its support and encouraged people with information about the investigation to contact its security team at security@ledger.com, as stated in the update.
Ledger’s guidance for potentially affected customers remains specific to CryptoBilis purchases. Customers who bought a Ledger device from the reseller within the previous 90 days and have not initialized it should not begin setup. Those who have already configured a potentially affected device should consider moving assets to a new Ledger signer using a newly generated recovery phrase, following the company’s instructions.
Ledger has also reiterated that it will never call or send direct messages asking customers for their 24-word recovery phrase. Users seeking assistance should use Ledger’s official support channel.
The company had confirmed an unauthorized hardware implant in one affected user’s device in an earlier update and urged users to re-seed.
Researcher Reports a Tampered Device Purchased in Europe
Security researcher Johannes, posting under the X handle @0xJohannes_, said the Ledger incident was not limited to Asia. Johannes described a device he said he had purchased approximately two weeks earlier from MediaMarkt, a European consumer-electronics retailer.
According to the researcher, the device contained what appeared to be a hardware implant resembling an earlier version of the modification reported in the CryptoBilis-linked devices. Johannes also said he was aware of reports involving devices in Asia, South America, and Europe.
The European device remains a separate, researcher-reported finding. Ledger has not confirmed that it is part of the same incident, and the reported purchase from a European retailer does not by itself establish a wider attack on Ledger’s authorized distribution network.
Johannes said the device had not transferred funds to an exploiter. He suggested two possible explanations: the implant might not have worked, or an attacker might have been waiting before using the device. These were the researcher’s hypotheses, not verified findings about the device’s operation or the attacker’s intentions.
The report therefore raises questions about the potential distribution of tampered hardware, but it does not establish that a larger population of compromised devices is waiting to be activated. Ledger responded to the researcher’s discussion by directing readers to its latest update, maintaining its position that all confirmed cases connected to the October 9 draining incident involved CryptoBilis.
The distinction is important: a device reported as tampered with is not automatically a confirmed victim of the same attack, and the extent of any relationship between the European report and the Southeast Asian cases remains unresolved.
CZ Claims Hackers Bought the Reseller
Binance co-founder Changpeng “CZ” Zhao made a separate claim about CryptoBilis’ ownership. Reacting to discussion of the incident on social media, CZ wrote that the hackers had “apparently bought the reseller” and made it sign a non-disclosure agreement.
The wording was CZ’s own characterization, and the claim that the buyer was connected to the attack has not been established.
However, CryptoBilis’ ownership history has been reported separately. The company’s former co-founders said they handed over administrative, operational and system access to new management after a sale that closed in March 2026. Corporate records cited in the report indicated that the share transfer was finalized later in the year. The report also said an NDA accompanied the transaction.
Those details support the existence of an ownership change, but they do not establish that hackers acquired the business, that the buyer arranged the hardware tampering, or that the NDA was intended to conceal a criminal operation. The connection between the ownership transfer and the security incident remains unproven.
CZ had previously described the Ledger episode as a potential supply-chain attack involving one vendor.
What Users Should Do
The reports highlight the risks associated with tampering somewhere between a hardware wallet’s manufacture and its delivery to a customer. However, users should not assume that every device bought outside Ledger’s online store has been compromised, nor should they rely on a do-it-yourself physical inspection as a definitive security test.
Customers concerned about a device’s provenance should follow the manufacturer’s official guidance and contact Ledger Support rather than attempting to disassemble the device themselves.
For customers who bought devices through CryptoBilis within the 90-day period specified by Ledger, the company’s guidance is more direct: do not initialize an unused device, and consider moving assets from an already configured device to a new signer with a newly generated recovery phrase.
Users should never share their recovery phrase with anyone claiming to represent Ledger or another support service. A recovery phrase can provide control over the associated wallet, so anyone who obtains it may be able to move the assets.
The wider investigation remains focused on how the affected devices were modified, how many units may have been involved and whether the European report is connected to the confirmed CryptoBilis-linked cases.
Why the Supply Chain Matters
The CryptoBilis incident highlights a security risk that differs from a conventional software breach: hardware can potentially be modified before it reaches its buyer. A device may appear legitimate while containing unauthorized components, making the chain of custody between manufacturer, reseller and customer an important part of hardware-wallet security.
Ledger says its own systems and direct sales channels remain unaffected, and it has described the confirmed cases as limited to devices sold through CryptoBilis. The separately reported European device and the reseller’s ownership history raise additional questions, but neither currently proves that the confirmed incident has spread beyond the original distribution channel.
The investigation will need to establish whether the reported devices share the same modification, whether the ownership change is relevant to the tampering and how many customers may have been exposed. Until those questions are answered, claims about the scale of the attack or the motives of the people involved should remain attributed and qualified.
The Crypto Times will continue to monitor developments as Ledger and independent researchers release further findings. The publication also contacted Ledger for comment at 04:28 UTC on October 12, 2026. This story will be updated if the company responds.
Also Read: Kalshi Probes $173 in Bets That Called Trump’s Press Secretary Pick Katie Zacharia at 1% Odds
