Ledger confirmed: some hardware wallets sold through a large Southeast Asian reseller, CryptoBilis, contained a foreign module. Money did not leave the company’s cloud; it left specific units bought off the official storefront.
What is known
In September researchers showed fake Ledger X units at almost half the original price. On 9 October Ledger opened an investigation and asked CryptoBilis to stop shipping. The next day the company confirmed an unauthorised module on at least one device. Every sudden-wipe case it knows of it ties only to this network; the volume it calls “limited”.
Independent teardowns describe the same idea: the module reads the screen and keypresses to lift the seed and takes it out over cellular. Official Genuine Check is not built for that: if the native Secure Element is in place, the program says “original”.
What a buyer should do
Ledger asks anyone who took a device from this reseller and has not set it up yet not to run the wizard. Anyone who already set one up should move assets to a new signer with a new seed. Buy only from the company or authorised shops, not a marketplace “seller in China, warehouse Malaysia”. Returns to resellers should not go back on the shelf.
What to take from this
A hardware wallet protects a key from malware on a computer, not from a pried-open case in transit. A price “like the official one, only cheaper” is a red flag here, not a discount. There is no sign yet that other networks ship the same thing, but trust in the grey channel is already broken. Count as safe only a box with a clear supply chain, not a sticker on the screen.
