CryptoBilis case: Ledger widens sales suspension after hardware implants found in wallets

For buyers in Israel, the practical question is not just which hardware wallet to choose. They also need to establish who sold the device, what happened to it before delivery and whether the setup instructions came from a trustworthy source. A genuine device and a secure supply chain are not the same thing.

What Ledger published, and what is known about CryptoBilis

Ledger's official update on the hardware attack (Opens in a new tab) describes attackers buying genuine devices, opening them, adding hidden components and returning them to distribution through regional resellers. The company says the components were intended to capture seed phrases during wallet creation. It said its security laboratory, Donjon, had dismantled the implant and examined its operation.

Earlier reports focused on CryptoBilis, a reseller in Southeast Asia. On 12 October, CoinDesk reported, attributing the information to Ledger statements, that an unauthorised implant had been confirmed in at least one device sold through it and that the cases verified at that point were linked to the reseller. This describes the information available at that stage of the investigation, not proof that every device sold there was compromised or a finding about who was responsible for the implants.

On 13 October, The Block reported that MediaMarkt Saturn had suspended sales of Ledger devices in stores and online, quoting a group spokesperson. Separately, Ledger said in its later update that it had also conducted sample checks in German stores and warehouses and found no compromise in the devices examined. A clean sample is not a check of every device sold.

The crucial distinction: the seed phrase, not just the chip

A hardware wallet is intended to separate sensitive operations from a computer or phone. However, seed phrases generally allow the keys controlling the funds to be recovered in a compatible wallet. Someone obtaining them may be able to spend the funds without possessing the original device or knowing its unlock code. Protecting the device and protecting the backup are therefore separate layers.

Ledger says it found no vulnerability in its chip, operating system or servers, and that its systems were not breached. That does not mean a physically altered device is safe to use. On the contrary: according to the company, the implant aimed to obtain the secret when it was displayed to the user, without needing a conventional software breach.

For readers new to the terms, the explanation of seed phrases and private keys distinguishes wallet backups, application passwords and device codes. Changing a password alone does not revoke access for someone who has already copied a seed phrase.

Before setting up a device bought from the reseller

Anyone who bought a device from CryptoBilis and has not yet set it up should pause setup and check the current guidance with Ledger's official support. Early reports carried a warning for buyers within a certain period before the incident was discovered. That previously quoted window should not be treated as clearance for an older device, especially after regional precautions were widened.

Keep the invoice, seller details, purchase date and packaging. Unusual external signs can be documented without revealing secret information. Do not dismantle a suspected device to diagnose it yourself: a laboratory examination is not a home check, and dismantling it may damage the device and evidence of the incident.

If the device has already been set up and official guidance indicates a risk that the backup was exposed, a safe move requires a wallet with a new seed phrase generated in a trusted environment. Entering the same words into a new device does not create a new secret. Before transferring, understand the process, check the destination address on a trusted device and contact support through an address you reached independently. Do not disclose the seed phrase to support.

What to check in the next purchase, without promising immunity

It is better to reduce unknown links in the chain: consider buying directly from the manufacturer or verify a reseller against its current official list. A familiar name on a marketplace does not replace identifying the actual seller. A normal price and apparently new packaging also do not prove that the device never passed through another party.

Follow the manufacturer's packaging and device checks and the authenticity check in its official application, but do not treat such a check as insurance against every physical alteration. Ledger's support guidance stresses that the seed phrase sheet arrives blank: never use words supplied in advance on a note, in a message or by the seller. Create the wallet only under the official instructions.

According to the 15 October update, Ledger also reinforced that returned devices must not be resold and required stock to be kept away from accessible display shelves. These are company distribution measures, not checks a consumer can substitute for them. The broader context is explained in the guide to crypto wallets and responsibility for keys.

As checked on 16 October 2026, the company's announcement did not provide a complete public list of compromised devices or a verified aggregate loss figure. There is therefore no final damage total or blanket clearance for devices not mentioned here. The practical conclusion is narrow and clear: check the device's origin, do not begin setup when there is cause for suspicion, and do not turn a request for help into disclosure of the backup.