At 17:13 UTC on October 11, Ledger said every confirmed case from a draining incident disclosed on October 9 involved devices sold through CryptoBilis, a reseller in Southeast Asia. The company described the number of affected devices as limited. It did not put a number on the devices or the funds lost in the update.
Ledger said its own systems and direct sales channels remained unaffected. Its investigation is continuing with relevant authorities, and it is contacting affected users. CryptoBilis has stopped selling hardware wallets, according to the statement.
What Ledger has confirmed
The update narrows Ledger’s confirmed cases by distribution channel. Every case confirmed by the company so far concerns a device sold through CryptoBilis. That scope matters because Ledger did not describe a compromise of its systems or products bought directly from the company. It also leaves the size and cause of the incident open. The word “confirmed” limits the statement to cases Ledger has verified as part of its investigation.
Ledger called the post a 72-hour update. The company said it was working with authorities and knew the incident was concerning for people directly affected. Its team is reaching out to those users. Ledger also credited SEAL 911 for support during the response.
The company did not announce a completed investigation. It said it was “actively investigating” the CryptoBilis situation and asked anyone with relevant information to contact its security team. That leaves two basic facts unresolved: how the devices were compromised and how many users lost funds.
CryptoBilis has confirmed that it ceased all hardware-wallet sales, Ledger said. Users who believe they were affected should contact Ledger Support through official channels and file a complaint with local law enforcement. Ledger said its support team is available 24/7.
Instructions for CryptoBilis buyers
Ledger gave separate instructions for unused and initialized devices. CryptoBilis customers with an unused device should not initialize it. A buyer who already set up a device should move the funds to a new seed on a device bought from Ledger. That instruction requires a fresh seed rather than continued use of the seed created on the CryptoBilis device.
The company’s standing authenticity guide recommends buying directly from Ledger or through its authorized distributor and reseller network. It lists the product’s origin, box contents, recovery sheet, initial device state and hardware integrity among the checks available to a buyer.
The same guide says a new Ledger setup provides a new 24-word Secret Recovery Phrase. It also warns that anyone who knows that phrase can access the associated crypto assets. For device authenticity, Ledger Wallet performs a cryptographic Genuine Check that confirms the device contains a genuine secure element. The company says only a genuine secure element can use its manufacturing key to return the proof required by that check.
Those checks do not replace Ledger’s incident-specific direction. CryptoBilis buyers have been told not to initialize unused devices. Customers who already initialized one have been told to move funds using a new seed and a device purchased from Ledger.
For a user holding funds through an initialized CryptoBilis device, the instruction is an asset-migration step. Ledger’s guidance does not tell that user to keep the existing recovery phrase with different hardware. It calls for a new seed on a device from Ledger. The authenticity guide explains why the seed matters: anyone who knows the recovery phrase can access the crypto assets. This makes the source of the replacement device and the generation of a fresh phrase part of the same response.
An unused CryptoBilis device has a simpler status under the update. Ledger says not to initialize it. The company directs buyers with concerns to official support instead of asking them to run an experiment with the device. Its broader guide describes Genuine Check as verification of the secure element, but the incident notice still gives CryptoBilis buyers the more specific stop instruction.
Ledger also warned that scammers may use the incident as a pretext. The company said it will never call a user, send a direct message or ask for a 24-word recovery phrase. A contact making any of those requests is not following Ledger’s stated support process.
Reseller controls under review
Ledger reminded authorized resellers and distributors to buy products only through authorized channels. It also told them never to put returned products back into stock. For buyers, the company advised against unauthorized resellers because a device may be suspicious, counterfeit or modified and may fall outside Ledger’s security guidelines.
The company is reviewing its authorized-reseller controls and advancing hardware protections. It also said it is cooperating with authorities. Its planned work reaches beyond its own sales network: Ledger called for researchers, vendors and partners to improve chain-of-custody practices and anti-tamper techniques across the hardware-wallet industry.
That response puts the reseller path at the center of the confirmed investigation. The available statement does not say whether the suspected modification happened before CryptoBilis received the devices, while they were in its custody, after a return or at another point in distribution. Ledger’s instruction not to restock returned products identifies one control it wants resellers to enforce, but does not establish that a returned product caused this incident.
The practical boundary for users is narrower than a recall of Ledger devices. Direct buyers are outside the confirmed CryptoBilis cases described in the update. CryptoBilis buyers have explicit instructions based on whether a device remains unused or has already generated a seed. Users with relevant information can contact Ledger’s security team, while people who believe their device was affected can use official Ledger Support.
Ledger has not set a date for a final report. The next update needs to establish the cause, the number of confirmed devices and whether the current CryptoBilis-only scope changes as the investigation continues.
