The reseller was authorized. Genuine Check could authenticate the Secure Element. But who verified the device delivered to the customer?
Abstract
On October 9, 2026, Ledger began investigating cryptocurrency thefts involving customers who had purchased hardware wallets from CryptoBilis, an authorized reseller in Southeast Asia. The following day, Ledger confirmed that at least one affected device contained an unauthorized hardware implant. Independent blockchain investigators estimated losses exceeding $100 million by October 12, although Ledger has not verified that total or established that every reported theft resulted from the same mechanism.
The case raises a question that goes beyond the hardware implant itself. Ledger’s Genuine Check cryptographically verifies the authenticity of a device’s Secure Element. But Ledger had already acknowledged that this mechanism could not detect malicious circuits added around an otherwise genuine chip. Its recommended protection against that residual risk was to purchase through Ledger or an authorized reseller.
CryptoBilis was such a reseller. Moreover, its former founders stated that the business had been acquired and operational control transferred to new management in March 2026. The company’s commercial identity and recognition as a reseller persisted even as the people operating the business reportedly changed.
Ledger’s security model therefore relied on two different forms of trust: cryptographic authentication of a component and commercial recognition of the organization delivering the finished product. Neither independently established that a particular device had remained physically unmodified between manufacture and delivery.
This article reconstructs the incident, the hardware architecture, the reseller’s change of control, and Ledger’s own distribution policies. It examines exactly what each mechanism established, how their assurances were intended to work together, and where the available evidence stops.
The central question is not whether Ledger promised absolute security. Its published documentation explicitly recognized the limits of its protections. The question is more specific: what did Ledger actually guarantee, and what remained unverified when a customer followed its recommended purchasing process?
1. Incident Overview — The Authorized Reseller
On October 9, Ledger acknowledged reports that customers in Southeast Asia had lost cryptocurrency after purchasing hardware wallets from CryptoBilis. The company asked CryptoBilis to suspend sales and shipments while an investigation proceeded.
CryptoBilis was listed in Ledger’s official reseller directory for Malaysia, Indonesia, and the Philippines. Customers who purchased from the business were therefore not necessarily buying from an unauthorized marketplace seller. They could have selected a retailer expressly identified by the manufacturer as an authorized purchasing channel.
Ledger initially advised customers who had bought devices from CryptoBilis during the preceding 90 days not to initialize unused products. Those who had already configured their wallets were advised to move their assets to a newly generated recovery phrase on a trusted device.
On October 10, Ledger confirmed that one affected customer’s device contained an unauthorized hardware implant. The company stated that it had no indication that its internal security infrastructure, systems, or services had been compromised.
In its subsequent 72-hour update, posted on October 11 and widely reported on October 12, Ledger said the number of affected devices appeared limited and that all cases confirmed to that point involved products sold through CryptoBilis. The reseller had confirmed that it had stopped hardware wallet sales. Ledger also announced that it was reviewing authorized reseller controls and advancing hardware protections while cooperating with authorities.
These statements establish a narrower incident than the initial estimates might suggest. Ledger has confirmed physical modification of at least one device, but has not publicly identified the location where the modification occurred, the number of affected devices, or the exact relationship between the confirmed implant and the broader set of reported thefts.
Independent blockchain investigators have described a much larger financial event. In its October 12 update, Bitquery counted approximately $102.0 million taken from 324 wallets on six blockchains. Those figures are derived from transaction clustering, not a confirmed victim census. A blockchain address is not necessarily a distinct victim, and the transactions alone cannot establish how the relevant keys were obtained.
Why the customer trusted CryptoBilis
One purchaser’s account illustrates the role of Ledger’s reseller recognition.
In a Reddit post, a user claiming to have lost almost 100,000 USDT explained that an initial attempt to buy directly from Ledger had been cancelled. The user then visited Ledger’s website, found CryptoBilis listed under Malaysia, and purchased a new device through that seller.
The user said the product was sold at the normal price, with sealed packaging and no apparent indication that it had been previously used.
The account is self-reported, and the individual transaction and purchase records have not been independently verified. Nevertheless, it describes an important interaction between the manufacturer’s guidance and the customer’s decision.
The buyer did not need to independently determine whether CryptoBilis was reputable. Ledger had already provided a directory identifying recognized retailers. A customer looking for a safer purchasing route could consult that directory and select a seller accordingly.
This was also consistent with Ledger’s own purchasing guidance. The company recommended combining Genuine Check with purchases made directly from Ledger or through authorized resellers.
The incident therefore exposes a specific problem. A customer could follow the manufacturer’s recommended purchasing process and still receive a product whose physical integrity had not been established.
To understand why, it is necessary to separate the history of the implant from the history of the reseller.
Sources: The Block, October 9; CoinDesk, October 12; Ledger official reseller directory; Purchaser’s Reddit account.
2. Attack Timeline — The Hardware, the Company, and the Theft
Three overlapping histories matter to this investigation: the development of physical implants targeting Ledger Nano X devices, the ownership and management transition at CryptoBilis, and the eventual cryptocurrency withdrawals.
They are relevant to one another, but the available public evidence does not establish a complete causal chain connecting them.
| Date | Event | Significance |
|---|---|---|
| August 2025 | An early public report describes a modified Ledger Nano X used to steal cryptocurrency | Establishes an earlier physical implant threat |
| March 2026 | Former CryptoBilis founders say they completed the operational handover after an acquisition | The business’s actual management reportedly changed |
| May 2026 | Joe Grand publishes a reverse-engineering analysis of a Nano X implant | Demonstrates recovery-phrase interception through display signals |
| August 2026 | Reports citing Malaysian company records describe a share transfer associated with CryptoBilis | Indicates a possible later legal ownership milestone |
| September 2026 | Tibane Labs obtains two newer implanted devices through Japanese marketplaces | Documents more concealed and installation-oriented hardware |
| Late September–early October | Bitquery identifies preparatory and small test transactions | Suggests activity preceding the large withdrawals |
| October 9 | Large thefts become public; Ledger asks CryptoBilis to halt sales | The incident enters public investigation |
| October 10 | Ledger confirms an unauthorized implant in one affected device | Direct evidence of physical modification |
| October 11–12 | Ledger issues its 72-hour update; OneKey announces separate action concerning CryptoBilis | Manufacturer responses begin changing the status of the distribution channel |
2.1 A physical attack that did not need to break the Secure Element
In May 2026, hardware security researcher Joe Grand presented an analysis of a modified Ledger Nano X discovered in an earlier case.
The device contained a legitimate Ledger circuit board together with additional electronics. Rather than extracting cryptographic secrets directly from the Secure Element, the added hardware observed data transmitted from the Secure Element to the device’s OLED display.
During initial setup, a hardware wallet generates and displays a recovery phrase. The user is expected to record those words securely, because they can be used to reconstruct the wallet’s private keys.
The implant exploited that legitimate operation. Its microcontroller reconstructed information from the display communication, while a cellular modem, SIM, and antenna provided an independent route for transmitting captured data.
The normal screen continued to function. From the user’s perspective, the device could behave like an ordinary wallet.
In September, Tibane Labs acquired two further modified Nano X devices through different Japanese marketplaces. One was purchased on Yahoo! Auctions Japan. The other came through Amazon Japan, from a China-based seller, with shipment originating in Malaysia.
These specimens showed significant changes in construction.
The earlier implant relied on manually soldered wires and a reduced battery. The newer versions used customized flexible printed circuit boards that fitted the Nano X layout. One placed its electronics beneath the display, retained the original battery, and concealed component markings.
Such features are consistent with a design intended to make installation more repeatable and detection more difficult. They do not, by themselves, establish the number of units produced or the existence of a particular manufacturing organization.
Importantly, neither of the September specimens was purchased from CryptoBilis. Tibane Labs had not established that the devices shared an origin with the implant confirmed by Ledger in October.
The hardware research demonstrates a credible attack mechanism and its technical development. It does not yet identify the manufacturer or distribution route of the CryptoBilis victim device.
2.2 CryptoBilis had changed hands
Following the October incident, CryptoBilis’s former co-founders, Arravind Prabu and Vimalatheethan, provided a statement to Tibane Labs.
They said CryptoBilis had been acquired earlier in 2026 and that they had completed the transfer of operational, managerial, and administrative responsibilities in March.
According to their statement, they no longer had credentials or administrative access to the company’s backend systems, customer databases, order histories, or corporate communications. They had assisted with certain industry events after the acquisition but said they were no longer involved in daily operations.
They also stated that contractual confidentiality obligations had delayed a joint public announcement until mid-October, although suppliers had already been notified of the ownership and management transition.
Separate reporting citing Malaysian corporate-registry images described an August share transfer. The underlying records have not been independently verified for this article. The reported operational handover in March and the later corporate filing should therefore be treated as distinct events.
The change of ownership attracted speculation that the acquisition itself might have been part of the attack. No public evidence currently establishes that proposition.
Acquiring a reseller could theoretically provide access to its commercial relationships, inventory, or fulfillment operations. But the usefulness of such access does not demonstrate malicious intent or involvement in the modification of any specific device.
What the acquisition does establish, if the former founders’ account is accurate, is that the organization operating CryptoBilis changed while its outward commercial identity continued.
That distinction matters because Ledger’s reseller authorization was attached to a recognized selling business, whereas the physical handling of products depended on whoever actually controlled that business’s operations.
2.3 The withdrawals were coordinated
Bitquery’s on-chain investigation found small transactions and other preparatory activity preceding the large withdrawals on October 9.
Some operations occurred in unusually concentrated sequences. On TRON, Bitquery reported that 25 wallets performed the same type of approval operation within approximately three seconds.
That timing is consistent with an attacker already possessing multiple signing capabilities and executing a coordinated withdrawal procedure.
Such behavior fits a scenario in which recovery phrases were collected before the thefts were executed. A wallet does not have to remain connected to the implant after its recovery phrase has been disclosed. The phrase can be imported into another wallet environment and used later.
However, the blockchain record does not reveal where those phrases came from. Bitquery’s $102.0 million cluster cannot automatically be attributed to the confirmed hardware implant.
The attack timeline therefore contains several established components, but its central handoff remains unknown: how the modified devices entered the affected purchasing channel, and which reported thefts originated from them.
Sources: Joe Grand, Grand Idea Studio; Tibane Labs, hardware examination and former founders’ statement; BitPinas, ownership reporting; Bitquery investigation.
3. Architecture of Trust — What the Device Could Prove
Ledger’s security architecture relies on protecting cryptographic secrets within a Secure Element and ensuring that sensitive operations are confirmed through the device itself.
But the security of an electronic component is not identical to the physical integrity of a finished product.
That distinction is central to this case.
3.1 Genuine Check authenticates a component
Ledger’s Genuine Check uses an attestation mechanism to verify that a device contains an authentic Secure Element.
During manufacture, the Secure Element generates a unique cryptographic key pair. Ledger’s Hardware Security Module authenticates the public key under its Root of Trust, enabling subsequent verification that the responding component possesses the corresponding private key.
When a user performs Genuine Check, Ledger’s verification infrastructure sends a challenge. The Secure Element signs the challenge, and the response is checked against the authenticated device information.
A successful check establishes the authenticity of the Secure Element.
This is a meaningful protection against counterfeit devices. An attacker who builds a replica wallet cannot simply reproduce the cryptographic identity of a legitimate Secure Element.
However, the attestation does not measure every component connected to that chip.
Ledger’s own Donjon threat model makes this distinction explicit. If the original Secure Element remains intact, Genuine Check cannot necessarily identify unauthorized additions to the surrounding hardware, including spying implants.
This limitation was also described in Ledger’s purchasing guidance updated on September 18, 2026, before the CryptoBilis incident.
In other words, the possibility that a modified device could retain a genuine Secure Element was not a previously unknown failure mode.
It was already part of the manufacturer’s documented security model.
3.2 The screen created a second boundary
The Secure Element protects the recovery phrase and private keys against many attacks targeting the device’s software and hardware.
Yet the wallet must communicate certain sensitive information to the user.
During initial setup, the recovery phrase must appear on the screen so the owner can record it. That process moves information from a protected cryptographic environment into a human-readable interface.
Ledger’s Secure Screen architecture is intended to provide a trusted display. It allows the user to inspect transaction details without relying solely on a potentially compromised computer or smartphone.
But the integrity of displayed information and the confidentiality of the physical signal carrying that information are different security properties.
The implant analyzed by Joe Grand intercepted the OLED display communication. It did not need to falsify the words on the screen, corrupt the Secure Element’s firmware, or extract the seed from the chip’s internal memory.
Instead, it observed the data generated by a legitimate operation.
This distinction explains why cryptographic authentication alone was insufficient. A genuine Secure Element could authenticate correctly while unauthorized electronics outside the authenticated boundary captured sensitive display information.
The attack did not require the authentication mechanism to return a false result. The result could be correct while answering a narrower question than the customer needed answered.
Whether the particular CryptoBilis victim device confirmed in October completed Genuine Check successfully has not been independently documented. The compatibility of such an attack with successful Genuine Check is established by the architecture and earlier implant analysis, not by a published test of every affected device.
3.3 Ledger’s answer was to trust the distribution channel
Ledger’s purchasing guidance did not stop at explaining the limits of Genuine Check.
It recommended purchasing from Ledger or from authorized resellers as a way to reduce the risk of receiving modified hardware.
The company described security controls in its distribution network, including relationships with major logistics providers, a recognized reseller program, and commercial policies intended to discourage gray-market sourcing.
Authorized resellers were encouraged through commercial arrangements to obtain products directly from Ledger or authorized distributors. Distribution agreements also prohibited partners from placing returned devices back into inventory for resale.
These measures address legitimate physical supply-chain risks.
A genuine wallet may be modified after manufacture. A returned unit may be compromised before being resold. An intermediary outside the approved network may introduce additional handling stages that the manufacturer does not control.
Commercial authorization and distribution policies can reduce exposure to these scenarios.
But unlike Genuine Check, these mechanisms do not produce a cryptographic proof about an individual device.
They operate through companies, contracts, incentives, people, and physical processes.
The remaining security of the finished wallet therefore depended partly on the effective operation of the organizations carrying it through the supply chain.
This is where the CryptoBilis acquisition becomes directly relevant.
Sources: Ledger Donjon — Genuineness Threat Model; Ledger Donjon — Secure Display and Inputs; Ledger — Best Practices to Securely Buy Your Ledger Signer.
4. What Did Ledger Actually Guarantee?
Ledger described buying from itself or an authorized reseller as safer when combined with Genuine Check. It did not state that either step unconditionally guaranteed the physical integrity of every device sold.
The question is what each mechanism established, and whether those limited assurances answered what the customer needed to know about the finished product.
| Mechanism | What it establishes or seeks to enforce | What remains outside its direct verification |
|---|---|---|
| Genuine Check | Authenticity of the Secure Element | Unauthorized additional hardware |
| Secure Screen | Trusted control of displayed information | Physical interception of display communication |
| Authorized Reseller | A manufacturer-recognized commercial seller | The physical state of every unit sold |
| Distribution policies | Preferred sourcing and restrictions on returned products | Proven compliance for each individual device |
| Official reseller directory | A publicly identified authorized purchasing channel | A complete, current history of the seller’s inventory and operating conditions |
These are not equivalent forms of assurance.
Cryptographic authentication verifies a property of a component. Commercial authorization recognizes an organization. Contractual restrictions govern behavior. None automatically records everything that happened to a particular device during distribution.
4.1 What was actually authorized?
Ledger’s public reseller application requests information about a business’s registered identity, location, website, retail channels, employees, turnover, product categories, geographic markets, and after-sales support.
These questions are relevant to evaluating a sales partner.
They describe an organization, however, rather than the condition of the individual products it will eventually sell.
The publicly available application does not explain what happens when the controlling shareholders, directors, inventory managers, or procurement operations of that organization change.
It does not disclose the full requirements for continuing authorization after a change of control, nor the precise process for monitoring an existing reseller’s operations.
Those requirements may exist in private contracts or internal reviews. Their absence from the public application is not proof that Ledger lacked them.
Nevertheless, the CryptoBilis case demonstrates why the distinction matters.
According to the former founders, the actual people controlling the company’s systems and operations changed in March 2026. The company retained its external identity and remained recognizable as CryptoBilis.
Ledger’s official directory still listed CryptoBilis as an authorized reseller when the incident emerged.
The central question is therefore not simply whether the company was authorized.
What exactly was authorized: the continuing legal entity, the operating organization, a particular management structure, or a defined set of procurement and distribution practices?
These things can change independently.
A legal entity may survive an acquisition. Its contracts may remain in force. Its website, customers, and brand may be unchanged. Yet the people able to purchase products, manage inventory, control fulfillment, or access internal systems may be entirely different.
An authorization issued at one moment does not, by itself, establish that every relevant operating condition remains unchanged afterward.
This does not show that Ledger’s reseller review failed. We do not know when Ledger received notice of the acquisition or what subsequent review it conducted.
It identifies the precise subject that needs to be examined: what continuing conditions the reseller recognition depended upon, and how those conditions were verified when control changed.
4.2 What did the distribution policy enforce?
Ledger’s September purchasing guidance describes two distinct kinds of commercial control.
First, resellers are commercially incentivized to source products from Ledger or authorized distributors.
Second, distribution agreements contractually prohibit reselling returned devices as new inventory.
The distinction is significant.
An incentive encourages behavior. A contractual restriction creates an obligation. Neither automatically establishes that a particular transaction complied with the intended rule.
Even if CryptoBilis purchased genuine hardware through a fully authorized distributor, modification could theoretically occur afterward, during storage, fulfillment, or another physical handoff.
Alternatively, a modified unit could enter the channel before CryptoBilis received it. In that case, the reseller might be selling an already compromised product.
There is no public evidence that identifies which scenario occurred.
This is why a distribution policy cannot be evaluated solely by confirming that a seller belongs to an approved network.
The relevant evidence would have to connect specific products to actual procurement and handling records: purchase orders, inventory batches, delivery documentation, returns, warehouse access, and final shipments.
A recognized reseller is a property of a business relationship. Physical integrity is a property of an individual device over time.
The two are related, but they are not interchangeable.
4.3 The acquisition changed the object of trust
The corporate transition provides the most concrete reason to examine whether commercial recognition and operational reality remained aligned.
The former CryptoBilis founders stated that operational control had been transferred in March and that they no longer possessed backend credentials or visibility into daily activities. They also stated that suppliers had been informed of the acquisition.
Whether Ledger received that notice, what information it contained, and whether Ledger conducted a new assessment remain unknown.
Even so, the case exposes three separate states that can evolve on different schedules.
Corporate identity. The legal entity, commercial name, customer relationships, and recognized reseller identity can survive a transaction.
Operational control. Purchasing decisions, warehouse access, product handling, staffing, and information systems can change immediately or gradually.
Manufacturer recognition. Authorization may be renewed, suspended, reviewed, or retained according to procedures that are not necessarily visible to customers.
There is no general rule requiring all three to change at the same moment.
That separation is normal in corporate transactions. It becomes security-relevant when manufacturer recognition is used as a basis for choosing where to buy a product whose physical integrity matters.
A customer cannot directly observe a reseller’s internal control structure. They rely on the manufacturer’s recognition as an external indication that the purchasing channel meets its standards.
The incident therefore asks whether the recognized channel still satisfied the conditions that gave the recognition its security value.
The public record does not establish the answer.
But it shows why the question is not academic. Control over an authorized seller had reportedly changed before an incident involving the physical integrity of products sold through that channel.
4.4 How did authorization change once the incident was discovered?
The responses on October 11 and 12 offer an unusually concrete illustration of how commercial authorization operates after a security concern emerges.
Ledger’s 72-hour update said that CryptoBilis had ceased hardware wallet sales. Ledger reported that all confirmed cases were associated with the reseller, while stating that its own direct sales channels and systems showed no evidence of compromise.
The company said it was reviewing authorized reseller controls, advancing hardware protections, and encouraging broader work on chain-of-custody and anti-tampering measures.
On October 12, Ledger’s official directory still displayed CryptoBilis under Malaysia, with the entry reading “Cryptobilis- Sales temporarily paused.” The capture below preserves that day’s visible state. It does not establish when the label changed or whether Ledger had formally ended the reseller agreement.
Ledger’s Malaysia reseller directory on October 12, 2026. The listing remained visible with sales marked temporarily paused.
The entry conveyed both the continuing identity of the listed business and the current instruction to pause sales. A directory listing alone therefore cannot be read as permission to continue selling; a sales pause, a reseller review, and termination of authorization are distinct possible actions.
A second hardware wallet manufacturer, OneKey, took a different publicly reported action.
On October 12, OneKey founder Yishi announced that the company had terminated CryptoBilis’s authorized reseller status, paused the addition of new resellers, and begun reviewing existing dealers.
OneKey also offered free replacements to customers who had purchased OneKey devices through CryptoBilis between March 1 and October 12, 2026. The replacement offer was precautionary: OneKey said it had not received reports of corresponding losses among its own customers.
Yishi explained the March 1 cutoff: the former co-founders had said they handed over management in March, so OneKey included the whole handover month and subsequent purchases, choosing broader precautionary coverage. That decision did not establish that the acquisition caused the attack.
Ledger requested a sales halt and announced a review of its reseller controls; OneKey reported revoking authorization and offered replacements over a defined purchasing period. The decisions need not have identical criteria. Both show that reseller status can be reassessed as an operating relationship, while the physical condition of devices already sold remains a separate question.
4.5 What remained unproved?
Genuine Check could authenticate a Secure Element, and the directory identified a recognized seller. Neither recorded who handled a particular unit after manufacture or whether an unauthorized circuit had been added. Nor did the public listing show which operating conditions of the seller were checked again after its reported change of control.
That is the assurance left unverified here. It does not prove a broken promise, a failed reseller review, or the point at which a device was modified.
Sources: Ledger reseller application; Ledger official reseller directory; Ledger purchasing and distribution guidance; CoinDesk, October 12 update; TechFlow, OneKey announcement, October 12.
5. What Remains Unverified — Where Did the Device Become Compromised?
The public record does not locate the physical modification. Three bounded possibilities show why reseller status alone cannot settle the question.
5.1 Modification after the reseller received the product
Access to CryptoBilis’s inventory or fulfillment operations could have allowed genuine devices to be altered after arrival. That would make its handling records and operational controls relevant, but the management change is not evidence that the new operators modified any unit. Testing the route requires the affected device’s inventory and shipment history.
5.2 Modification before the reseller received the product
A device could have been modified by an upstream party before CryptoBilis received it, leaving the reseller unaware. Manufacturing identifiers, purchase orders, distributor records, and shipping documents would be needed to test that path.
5.3 A wider modified-device supply network
Tibane Labs found implanted Nano X units through two separate Japanese sales channels. A common source is possible, but so are independent operators using similar techniques. Comparing the confirmed victim device with those specimens would require their PCB designs, components, firmware, and cellular records; none of that comparison is public.
Evidence required to establish the missing links
| Question | Required evidence |
|---|---|
| Where was the victim’s device modified? | Device-specific chain-of-custody and hardware examination |
| Did several compromised devices share a common origin? | Comparative PCB, firmware, component, and cellular records |
| Did CryptoBilis’s acquisition change sourcing or fulfillment? | Procurement and inventory records before and after the handover |
| What did Ledger approve after the change of control? | Reseller agreements, notices, and internal review or approval records |
| Did the confirmed implanted device pass Genuine Check? | Device-level setup records or reproduced testing |
| How much of the reported financial loss resulted from implants? | Victim-device evidence linked to independently verified theft transactions |
CryptoBilis appeared in Ledger’s directory for three countries when the incident emerged, but that does not establish a common legal entity, supplier, or warehouse across them. The Malaysian ownership reports cannot identify every regional handling path. No available evidence attributes the modification to former owners, acquirers, or an upstream supplier.
6. Conclusion — What Was Actually Guaranteed?
Before this incident, Ledger documented that Genuine Check could authenticate a Secure Element while missing added spying hardware. It recommended buying through Ledger or authorized resellers to reduce the remaining supply-chain risk. That was a recommendation for a safer route, not an unconditional assurance about every finished device.
CryptoBilis was a recognized seller associated with customer theft reports and at least one confirmed hardware implant. Its former founders described a change in operational control months earlier. These facts do not show that the acquisition caused the modification or that Ledger failed a required review. They do show why the continuing identity of a seller, the people operating it, and the condition of a particular unit must be examined separately.
The customer who followed Ledger’s recommended route could check the chip’s authenticity and the seller’s listing. Those checks could not reconstruct the unit’s physical history. The unresolved question is which continuing conditions gave the reseller recognition its security value, and how those conditions were assessed after control reportedly changed.
The Secure Element could be authenticated. The seller could be recognized. The device delivered to the customer still required its own evidence of integrity.
References
Incident Investigation
- The Block — Ledger investigates wallet drains involving CryptoBilis buyers. October 9, 2026. Initial reports, Ledger’s response, and early loss estimates.
- CoinDesk — Ledger says unauthorized implant found in at least one device sold by CryptoBilis. October 12, 2026. Confirmation and subsequent Ledger update.
- Bitquery — The Ledger CryptoBilis Hack. Updated October 12, 2026. Six-chain transaction reconstruction.
- Reddit — CryptoBilis purchaser testimony. October 2026. Self-reported purchasing experience and losses; not independently verified.
Hardware Architecture and Authentication
- Ledger Donjon — Genuineness Threat Model. Cryptographic device attestation and its limits.
- Ledger Donjon — Secure Display and Inputs. Security objectives of the trusted display.
- Ledger — Best Practices to Securely Buy Your Ledger Signer. Updated September 18, 2026. Purchasing guidance, distribution policies, and physical tampering risks.
- Joe Grand — Reverse Engineering a Ledger Nano X Hardware Implant. Grand Idea Studio, May 2026. Physical implant architecture and reverse engineering.
- Tibane Labs — Ledger Nano X: The Spy Implant. October 2026. Examination of newer hardware specimens.
Corporate Control and Distribution
- Tibane Labs — Former CryptoBilis Co-Founders’ Statement. October 2026. Reproduced statement concerning acquisition and operational handover.
- BitPinas — CryptoBilis Ownership Investigation. October 2026. Reporting on the corporate transition.
- Ledger — Official Reseller Directory. Accessed October 12, 2026. Public authorized reseller listings.
- Ledger — Become a Ledger Reseller. Public partner application and qualification information.
- TechFlow — OneKey Terminates CryptoBilis Authorization. October 12, 2026. Reseller status termination, review, and precautionary replacements.