BTC $83,087.97 +0.73%
ETH $2,504.07 -0.40%
BNB $741.94 -0.38%
XRP $1.37 +0.20%
SOL $107.25 -0.67%
TRX $0.3275 -0.97%
DOGE $0.0842 -0.62%
ADA $0.2349 -3.19%
BCH $271.70 -1.09%
LINK $12.90 -0.28%
HYPE $81.19 -2.91%
AAVE $159.72 -1.28%
SUI $1.04 -2.47%
XLM $0.1910 -2.59%
ZEC $1,203.95 -3.23%
AAPL $343.81 +1.21%
AMZN $260.50 +0.21%
GOOGL $355.14 +0.93%
MSFT $546.04 +0.89%
META $764.03 +2.05%
NVDA $227.60 +0.38%
TSLA $375.33 -1.11%
SNDK $1,456.14 -2.10%
INTC $102.46 +0.87%
SPCX $157.16 -4.12%
MU $939.71 -5.51%
AMD $597.65 +0.92%
BTC $83,087.97 +0.73%
ETH $2,504.07 -0.40%
BNB $741.94 -0.38%
XRP $1.37 +0.20%
SOL $107.25 -0.67%
TRX $0.3275 -0.97%
DOGE $0.0842 -0.62%
ADA $0.2349 -3.19%
BCH $271.70 -1.09%
LINK $12.90 -0.28%
HYPE $81.19 -2.91%
AAVE $159.72 -1.28%
SUI $1.04 -2.47%
XLM $0.1910 -2.59%
ZEC $1,203.95 -3.23%
AAPL $343.81 +1.21%
AMZN $260.50 +0.21%
GOOGL $355.14 +0.93%
MSFT $546.04 +0.89%
META $764.03 +2.05%
NVDA $227.60 +0.38%
TSLA $375.33 -1.11%
SNDK $1,456.14 -2.10%
INTC $102.46 +0.87%
SPCX $157.16 -4.12%
MU $939.71 -5.51%
AMD $597.65 +0.92%

loss

All
Article
Flash

Hardware wallet distributor CryptoBilis announced the suspension of Ledger device sales to cooperate with the investigation into financial losses

Hardware wallet dealer CryptoBilis announced that, due to Ledger investigating a case involving fund losses for Southeast Asian users, the company has suspended all sales and shipments of Ledger devices and is cooperating with Ledger's investigation. Ledger previously stated that it is investigating reports of fund losses from Southeast Asian users who purchased products from this dealer, and as a precaution, has requested CryptoBilis to suspend the sales and shipments of related devices, advising users who purchased devices in the past 90 days not to set them up if they have not completed initialization.CryptoBilis reminds users who have completed setup to follow Ledger's advice and transfer their assets to a new Ledger signing device generated with a new mnemonic phrase. It emphasizes that the mnemonic phrase must be generated by the device during initialization and handwritten by the user; if the device comes with a pre-printed or written mnemonic card or paper, or if the mnemonic has been seen by others, the wallet should be considered unsafe, and users should not disclose their mnemonic phrase or PIN to anyone. The notice also warns to be cautious of third parties claiming to assist in recovering lost funds, as such proposals are often scams.For users who have already experienced fund losses, CryptoBilis recommends contacting their official customer service channels and providing the order number, purchase time and location, device serial number, affected wallet address, and transaction ID, while keeping the device and packaging, not resetting or discarding them, and suggests reporting to the police. The company stated that it will not send users links requesting them to connect wallets, input mnemonic phrases, or install software.

The theft incident at Ledger today is its largest security event, with a fake application causing a loss of 9.5 million dollars

Hardware wallet manufacturer Ledger has once again experienced a security incident today, with third-party security agencies estimating the losses to be close to 90 million USD. Ledger is investigating the financial losses related to devices sold by its Southeast Asian authorized distributor CryptoBilis and has requested the distributor to suspend sales and shipments, advising users who purchased devices through this channel in the past 90 days to exercise caution or transfer their assets. The cause of the incident has not yet been definitively confirmed, but it is suspected to involve supply chain or device tampering risks.Major historical attacks and financial loss incidents related to Ledger include:In 2018, early hardware and supply chain research vulnerabilities emerged. Security researchers demonstrated the possibility of tampering with the Nano S before it left the factory, as well as issues such as MCU bootloader bypass, isolation vulnerabilities, and Bitcoin change address injection. Ledger gradually released security announcements and completed fixes, with related issues mostly being research-level vulnerabilities or requiring physical contact with the device to exploit.In 2020, Ledger experienced a massive customer data leak. Attackers obtained e-commerce and marketing databases through third-party API keys and vulnerabilities related to Shopify, exposing over 1 million email addresses and approximately 272,000 to 292,000 detailed customer records, including names, addresses, and phone numbers. The hardware and private keys were not affected, but this incident triggered long-term phishing, social engineering, and counterfeit official letter scams.In December 2023, the Ledger Connect Kit suffered a supply chain attack. After a former employee fell victim to a phishing attack, their NPMJS account was compromised, and attackers released a malicious version of the Connect Kit, injecting malicious code into DApps that relied on the library, enticing users to sign fraudulent transactions. The active window of the attack was about 2 hours, with losses estimated between 480,000 to 600,000 USD. The hardware and Ledger Live itself were not directly breached.In January 2026, third-party Global-e order data was leaked. The payment and logistics partner's system suffered unauthorized access, exposing some Ledger.com order-related information, including names, addresses, and contact details. Ledger's own systems and private keys were not affected, but the phishing risk rose again.In April 2026, counterfeit Ledger Live application scams appeared on the App Store. The counterfeit application was listed for about a week, tricking users into entering their recovery phrases, with over 50 victims losing approximately 9.5 million USD across multiple blockchains. Apple subsequently removed it, and Ledger emphasized that it would never ask for 24-word recovery phrases.In August 2026, Ledger disclosed vulnerabilities related to Ethereum application signatures, including command interleaving causing display content to be out of sync with signature parameters, and Clear-signing bypass issues. The vulnerabilities required malicious hosts to cooperate, and Ledger stated that there was no evidence of actual user exploitation; related issues have been fixed in the new version.On October 9, 2026, a large-scale wallet draining incident related to the CryptoBilis distributor occurred, with estimated losses close to 90 million USD. Ledger is investigating, and the incident is suspected to involve supply chain or device tampering attacks targeting a single channel. The official sales have been suspended, and affected users are advised to migrate their assets.
app_icon
ChainCatcher Building the Web3 world with innovations.