Ledger confirms all October 9 wallet drains involved compromised CryptoBilis devices; advises users to migrate funds to new seeds.
Security & Exploits ·
Ledger confirmed on October 11 that every wallet drain case it has verified from an October 9 incident involved hardware devices sold through CryptoBilis, a Southeast Asian reseller that has since stopped selling hardware wallets. The company described the affected device count as limited but provided no specific numbers for devices or funds lost. Ledger stated its own systems and direct sales channels remained uncompromised and instructed users with initialized CryptoBilis devices to transfer their holdings to a new recovery phrase on a device purchased directly from Ledger, while those with unused devices should not set them up.