Ledger says every confirmed wallet theft identified in its supply chain investigation so far involves devices sold by Southeast Asian reseller CryptoBilis. In a 72-hour update published on Oct. 12, the hardware wallet maker said its manufacturing infrastructure, internal systems and direct sales channels show no signs of compromise.

The company added that the number of affected devices remains limited. It said its security team is contacting impacted users directly and is coordinating with local law enforcement and SEAL_911 as the investigation continues.

Tampering first identified in CryptoBilis devices

The latest update follows Ledger’s Oct. 9 disclosure that investigators had found physical modifications inside devices sold through CryptoBilis, which operates across Malaysia, the Philippines and Indonesia. According to the company, all verified compromises uncovered to date come from that reseller’s inventory.

Security researchers who dismantled the altered units reported additional hardware soldered onto the boards behind the OLED display. Their findings described custom circuitry that included a Nordic Semiconductor LTE modem, an embedded eSIM module and a micro-antenna. The purpose of the changes, according to the researchers and Ledger’s summary, was to capture a 24-word recovery seed phrase when it was generated and then send that information out over local cellular networks.

European reports remain unconfirmed

Ledger said it has not verified claims that similar tampering has been found in devices bought from third-party electronics retailers in Europe. Those reports have circulated on social media, but the company’s confirmed cases still point only to CryptoBilis.

At the same time, security analysts cited in the report cautioned that supply chain exposure may not necessarily be limited to one distributor if inventory moved through secondary distribution channels. Ledger’s update did not confirm any such spread, and the European cases remain unverified.

Reseller ownership changes and operating halt

The report also pointed to corporate records showing ownership changes at CryptoBilis. Those records indicate the company was fully acquired in March, and that in August all of its shares were transferred to a Chinese national under a nondisclosure agreement that barred the former owners from publicly discussing the sale.

After those changes, CryptoBilis suspended retail operations and online sales across Southeast Asia, according to the article. Ledger has not tied the ownership transfer itself to the tampering in confirmed terms, but the timeline forms part of the broader investigation background.

Ledger’s instructions to distributors and customers

As a precaution, Ledger told authorized distributors not to restock returned devices and to obtain products only through direct factory channels. The company also issued separate guidance for customers who bought hardware wallets through CryptoBilis.

For users who have unopened devices from that reseller, Ledger said the units should remain sealed and uninitialized. Customers already using an active device purchased through CryptoBilis were advised to move assets immediately to a new address created on an uncompromised signer. The next confirmed step is continued outreach to affected users while Ledger and external authorities work to determine the full scope of the incident.

Source: bitpinas.com