distributor

Hardware wallet manufacturer Trezor stated that in light of recent supply chain security incidents, it has decided to reduce the number of distributors to more effectively review partners.Currently, there is no evidence that Trezor devices have been compromised. This adjustment is a precautionary measure taken out of caution.

According to an official post from Ledger, its security team Ledger Donjon is investigating Ledger signing devices sold by the Southeast Asian distributor CryptoBilis, which have been implanted with unauthorized hardware components. Ledger confirmed this matter on October 10 regarding a device belonging to an affected user. Donjon's analysis shows that the implant is located within the device's casing and can read the screen display content—decoding the 24-word recovery mnemonic during the initial setup and transmitting it externally via LTE through a built-in eSIM; this component does not alter the security chip, system, or transaction signature.Currently, all confirmed financial losses related to the incident disclosed on October 9 involve devices sold by CryptoBilis. CryptoBilis has stopped selling Ledger devices. The total number of affected users and the amount of losses have not yet been verified, and Ledger is investigating similar implant reports from other distributors and regions.

The founder of the hardware wallet brand OneKey, Yishi, stated that recently multiple users who purchased Ledger hardware wallets through CryptoBilis reported asset theft. Ledger has confirmed that affected devices were implanted with unauthorized hardware, and the cause and scope of the impact are still under investigation. Since CryptoBilis also sold hardware wallets from brands like OneKey, OneKey has terminated its authorized dealer qualifications and will stop adding new dealers effective immediately.OneKey will re-evaluate existing dealers, and those who cannot verify the operating entity or ultimate beneficiaries will have their authorization canceled. A complete list of authorized dealers will be published after the review is completed. From March 1, 2026, to the date of this announcement, users who purchased OneKey hardware wallets through CryptoBilis, regardless of model, activation status, or usage, can apply for a free replacement. If the original model is in stock, a brand new device of the same model will be provided; if out of stock, a free upgrade will be given, shipped directly from the official OneKey store without the need to return the old device. Applications will be accepted until December 31, 2026, and must be submitted through OneKey's official website customer service or help.onekey.so with proof of purchase, device model, and usage status.OneKey reminds users that unactivated devices should refrain from activation and apply for a replacement directly; users who have used the device and have assets should proactively treat the old mnemonic phrase as potentially compromised, and transfer assets to a wallet created with a brand new mnemonic phrase as soon as possible, and should not import the old mnemonic phrase into a new device.

According to X user @0xJohannes, a Ledger hardware wallet purchased from an official dealer in Europe a few weeks ago was found to contain an unauthorized spy implant. The device has suspicious circuitry inside that genuine Ledger hardware does not possess, indicating it may have been physically tampered with before sale.The implant is suspected to be an older version, as newer versions typically hide components behind the screen. Funds in the affected devices have not yet been stolen. Currently, there are suspected case reports in Asia, South America, and Europe. If the original security components remain intact, Ledger's software Genuine Check cannot detect unauthorized physical modifications.

Hardware wallet dealer CryptoBilis announced that, due to Ledger investigating a case involving fund losses for Southeast Asian users, the company has suspended all sales and shipments of Ledger devices and is cooperating with Ledger's investigation. Ledger previously stated that it is investigating reports of fund losses from Southeast Asian users who purchased products from this dealer, and as a precaution, has requested CryptoBilis to suspend the sales and shipments of related devices, advising users who purchased devices in the past 90 days not to set them up if they have not completed initialization.CryptoBilis reminds users who have completed setup to follow Ledger's advice and transfer their assets to a new Ledger signing device generated with a new mnemonic phrase. It emphasizes that the mnemonic phrase must be generated by the device during initialization and handwritten by the user; if the device comes with a pre-printed or written mnemonic card or paper, or if the mnemonic has been seen by others, the wallet should be considered unsafe, and users should not disclose their mnemonic phrase or PIN to anyone. The notice also warns to be cautious of third parties claiming to assist in recovering lost funds, as such proposals are often scams.For users who have already experienced fund losses, CryptoBilis recommends contacting their official customer service channels and providing the order number, purchase time and location, device serial number, affected wallet address, and transaction ID, while keeping the device and packaging, not resetting or discarding them, and suggests reporting to the police. The company stated that it will not send users links requesting them to connect wallets, input mnemonic phrases, or install software.

The Malaysian hardware wallet distributor CryptoBilis has been revealed to have changed ownership during the investigation into a suspected supply chain attack on Ledger devices. Newly disclosed company records show that an individual named Jiaming, with a registered address in Heilongjiang Province, China, has held 100% of the company's shares since August 3.The former co-founder of CryptoBilis confirmed that the company was acquired in March of this year, and the original shareholders subsequently withdrew from all operational, management, and administrative positions. The founding team has been unable to understand the actual operations of the company after the handover, only continuing to assist with some activity coordination, and stated that they are no longer part of the company, urging the current management to handle the matter transparently.As the change in ownership was exposed, CryptoBilis has come under scrutiny for its alleged involvement in the supply chain attack on Ledger hardware wallets, with related devices reportedly implanted with hidden modules capable of stealing recovery phrases. There is currently no conclusive evidence linking the change in ownership to the wallet theft incident. CryptoBilis has temporarily suspended sales and shipments of all brand hardware wallets at its stores and online channels in Malaysia, the Philippines, and Indonesia, and has closed offline stores until further notice.

Zhao Changpeng issued a reminder for Ledger hardware wallet users to remain vigilant, especially those who have purchased devices recently. According to the information currently available, this incident appears to be limited to the supply chain, involving a supplier, and a few users may have purchased counterfeit or tampered Ledger devices.Zhao Changpeng stated that Ledger is a well-established and relatively secure hardware wallet brand in the industry, but such incidents can still occur. He anticipates and calls for the BNB ecosystem and the entire cryptocurrency industry to assist in tracking the stolen funds and promoting recovery.Previously, Ledger confirmed that it is investigating an asset theft incident involving Southeast Asian users, who had purchased devices through the distributor CryptoBilis. Ledger has requested CryptoBilis to suspend sales and shipments and advised users who purchased devices through this distributor in the past 90 days not to initialize their devices; if they have already completed the setup, they should create a new Ledger signing device using a new mnemonic phrase and transfer their assets to the new wallet.On-chain investigator Specter estimates that this incident has led to the theft of hundreds of wallets on the Bitcoin, Ethereum, and TRON networks, with losses exceeding 86 million dollars. Security researcher tanuki42 previously estimated the losses to be over 72 million dollars and stated that the amount is still increasing. Currently, the specific cause of the incident and whether the involved devices have security vulnerabilities are still under investigation.

According to official news, Pyth Network announced that it has become an external data distributor for Nasdaq Basic, integrating Nasdaq's real-time quotes and trading products for U.S. stocks into the Pyth data marketplace.It is reported that Nasdaq Basic is Nasdaq's real-time best bid and ask product for U.S. stocks. The best buy and sell quotes and order volumes come from the liquidity of the Nasdaq market center.

According to Zhitong Finance, this week, Standard Chartered Bank, Starway Technology under Fosun International, and Yunfeng Securities under Yunfeng Financial announced that they have become authorized distributors of the Hong Kong dollar stablecoin HKDAP. Along with the first batch of authorized distributors HashKey and OSL Group, the total number of authorized distributors for HKDAP has reached 5.

ChainCatcher news, according to Jinshi reports, Fosun Wealth Holdings announced on August 22 that it has become one of the distributors of tokenized structured notes for Singapore's largest bank, DBS Bank. This product is a participation note linked to cryptocurrencies, which pays cash returns when the price of digital assets rises, while limiting downside risk.

According to ChainCatcher, hackers who carried out a cyberattack on the pharmaceutical distributor Cencora received a ransom payment of $75 million in three installments in Bitcoin this March, as reported by Bloomberg citing informed sources. This is the largest known cyber ransom payment to date. The company reported costs related to the cybersecurity incident in its quarterly report in July, stating that $31.4 million of other expenses were primarily due to cybersecurity incidents related to data breaches. It remains unclear what this amount covers in relation to the cyberattack.Two months after the incident was disclosed, Cencora began notifying individuals and national authorities that personal data, including names, addresses, birth dates, diagnoses, prescriptions, and medications, had been stolen.Previously in July, cybersecurity company Zscaler and blockchain analysis firm Chainanalysis stated that the hacker group Dark Angels received a substantial ransom but did not disclose the identity of the victims.It is reported that the highest known amount of cyber ransom prior to the Cencora incident was $40 million, paid by insurance company CNA Financial Corp. in 2021.