Funding: CypherpunkGuide may earn referral fees through linked buying guides. This article contains no direct affiliate purchase links. No wallet vendor sponsored this analysis.
A hardware wallet keeps the keys used to authorize transfers. The coins are recorded on their networks, not stored inside the device. If someone obtains those keys, keeping your own device offline does not prevent that person from spending.
The urgent questions are where the device came from, whether it has been set up, and whether assets remain at risk. The eight-scenario decision table below separates those questions from what an authenticity check can prove. It is our analysis of published sources, not a device inspection or a tested recovery procedure.
What is known about the CryptoBilis reports?#
Ledger’s investigation concerns reported losses among buyers from CryptoBilis, a reseller operating in Southeast Asia. It is not confirmation that every Ledger device has been compromised.
On October 9, Cointelegraph reported Ledger’s warning and interviewed the company. Ledger had requested a pause in the reseller’s sales and shipments. It had not established a public cause, confirmed a loss total, or disclosed how many customers were affected. Ledger told the outlet it had received no reports involving direct purchases and that its own infrastructure, systems and services were not compromised. Those are the company’s statements during an ongoing investigation, not an independent guarantee for other buyers.
On October 10, 2026, we directly reviewed the full original Ledger Support post from October 9 and checked the purchase window and precautions against it. Check Ledger’s official channels for subsequent updates.
Bitquery’s separate analysis, reviewed on October 10, estimates $92.9 million across 311 wallets on five networks, including 203.8 BTC. These are that firm’s estimates; we did not recalculate every transaction. Wallets are not people, and the entire analyzed set has not been independently proven to consist of CryptoBilis buyers. Transaction patterns cannot establish where keys leaked. A wallet’s first deposit date also does not establish the date its owner bought a device.
Choose the response for your situation#
The reported October 9 warning covers CryptoBilis purchases within the 90 days preceding that warning. Being outside that window is not proof of safety; an unknown purchase route needs clarification rather than a guess.
| Your situation | First action | Avoid |
|---|---|---|
| Within the reported warning, not initialized | Stop setup and deposits; preserve the purchase record and check the latest official advice | Using recovery words supplied by the seller, or opening the device to declare it safe |
| Within the reported warning, initialized with assets | Consider migration to a trusted new device and newly generated recovery phrase; verify the destination and recovery arrangements | Restoring the old phrase on a replacement and treating that as new keys |
| Unexpected outgoing transfers already occurred | Preserve transaction IDs, times and purchase records; address any remaining assets and contact official support | Sending more funds for a purported diagnosis, or paying a stranger who guarantees recovery |
| Purchase route or date unclear | Check the invoice and seller identity through independently located official channels | Entering recovery words into a website that claims to check eligibility |
Never give recovery words, a PIN or an additional passphrase to a support agent, a website or someone contacting you by message. Ledger documents these approaches in its phishing warnings. Find support from the official website yourself; a search advertisement or incoming message is not verification.
What a passed Genuine Check cannot tell you#
Ledger’s Genuine Check cannot detect every unauthorized physical modification. Its own security documentation states that a spying implant can evade this check when the original Secure Element, the security chip, remains intact. The check also cannot verify the device’s physical supply-chain history.
Do not initialize a device covered by the reported warning just to run a check. For devices outside that do-not-initialize advice, use authentic software for the manufacturer’s checks and understand their scope. A passed check, intact-looking packaging or a successful test transfer does not prove that no one else knows the keys. This limitation does not establish that an implant caused the current losses.
Suspicion is a reason to stop using the device and seek official guidance, not to give yourself an informal certificate after a visual inspection. Disassembly can damage the device or alter evidence, and a beginner may not recognize a modification.
Replace exposed keys, not just the device#
If the recovery secret may have leaked, restoring it on another device preserves the same exposure. The BIP39 specification derives the same seed from the same recovery words and passphrase. A different PIN does not revoke that seed.
Migration to different keys requires a newly generated recovery secret in a trusted environment and a transfer of the remaining assets to the new wallet. Another account or receiving address under the old seed is not a substitute.
Before acting:
- Establish a trusted destination independently of the suspect device. Generate the new recovery phrase there and keep it private. Never enter the new phrase into the suspect device.
- Confirm that the destination supports the asset and network. Verify its full receiving address on the trusted receiving device; check the amount, network and fee before approving the transfer. Sparrow’s guidance explains the role of device-screen checks. A screen on a suspect device is not an independent guarantee.
- Confirm the destination’s recovery arrangements. Do not erase the old device before protecting remaining assets and confirming how to regain access. For routine preparation, use the receiving, signing and recovery checks.
A small test transfer can catch a destination error. It does not prove that a device or key is uncompromised. If theft is in progress, a fixed waiting period may leave assets exposed; this article does not prescribe one. Exact transfer steps depend on the device, asset and network. Do not upload a recovery phrase to a software tool or website to make the process faster.
If assets have already left#
Preserve evidence and protect what remains without exposing more private information. Keep transaction IDs, discovery times, purchase records and relevant messages. Share sensitive records only through verified support or appropriate official reporting channels; posting an invoice can expose your address and link your identity to wallet activity.
Contact Ledger through its official support site and, where appropriate, your local cybercrime authority or the relevant exchange’s verified support. Do not post your recovery words, PIN or passphrase, or submit them privately as evidence. The FBI’s recovery-fraud warning describes scammers charging victims for supposed recovery services. A promise of repayment or a request for an advance fee is a reason to stop. Tracing or freezing assets does not mean they have been returned.
Reduce future risk without adding unmanageable recovery problems#
Purchase verification, secret storage and transfer review address different failure modes. None is a promise that a hardware wallet cannot be attacked.
Use a verifiable purchase route, obtain software from the manufacturer’s official site, reject seller-supplied recovery words, and keep your backup away from cameras, cloud storage and support messages. Ledger’s buying guidance also acknowledges supply-chain risk. Switching brands with the same exposed recovery secret does not solve that exposure.
An additional passphrase creates a different wallet when combined with the recovery words. Ledger explains that setting one does not move existing assets into it. It adds another secret you must preserve. There is no established finding that a passphrase would have prevented this incident.
A 2-of-3 multisig wallet requires approvals from two of three independent keys to spend. It can reduce reliance on one key, but the wallet configuration and recovery requirements matter too. Do not learn a complex setup for the first time in a panic. Splitting a backup into SLIP39 shares is different: those shares recover one underlying secret rather than provide independent transaction approvals.
Keep a decision record without recording secrets#
The downloadable decision table covers eight situations, each with an action, a limitation and its source. It asks for no addresses, balances, order numbers or recovery secrets. It is a reading aid, not a scanner that certifies a wallet as safe.
Frequently asked questions#
Does this mean every Ledger is unsafe?#
No such conclusion has been established. The investigation and reported warning concern CryptoBilis buyers. An absence of reports from a sales channel does not establish that every device sold through it is safe.
Does a PIN change stop someone who has my recovery phrase?#
No. A PIN protects access to your particular device. Someone reconstructing a wallet from its recovery secret elsewhere does not need that device’s PIN. An additional passphrase, if used, is a separate part of the wallet’s recovery requirements.
Can I check my recovery phrase on a website?#
Do not enter real recovery words into a website, chat or support form. This article and its downloadable table do not need them. Use the manufacturer’s documented process on your own trusted device when a recovery or backup check requires secret input.
Sources and update record#
This analysis was checked on October 10, 2026. The incident remains unresolved in the sources reviewed. The framework is based on source analysis; no suspect hardware was examined and no live funds were moved. We directly reviewed the full October 9 statement on X on October 10 and checked its purchase window and precautions. Check Ledger’s official channels for subsequent updates.
