CryptoBilis
CryptoBilis sold Ledger hardware wallets in Southeast Asia until Ledger discovered an unauthorized hardware implant that accessed 24‑word recovery phrases, causing customer losses near $93 million. Ledger halted CryptoBilis sales, request its stop, and started an investigation; CryptoBilis ceased all sales and is not on Trezor’s authorized list as of January 1 2027. The implant was located in reseller units and the company is cooperating with Ledger’s security team. CryptoBilis is an authorized Ledger reseller. CryptoBilis sold Ledger hardware wallets that were later involved in tampered‑wallet incidents. Ledger ISSUES_ALERT CryptoBilis supply chain Safe 5 is sold by CryptoBilis CryptoBilis supplied a Trezor Safe 5 to a customer in August 2026. CryptoBilis sold a Trezor Safe 5 through Tokopedia in August 2026. Trezor removed CryptoBilis as a reseller on October 9, 2026. Trezor Support provides a replacement for devices purchased from CryptoBilis.· Entity summary generated by Graphiti
Relation timeline
BY VALID-FROM DATE- Crypto Fund 5PROVIDES REPLACEMENT FORCryptoBilis
Trezor Support provides a replacement for devices purchased from CryptoBilis.
- Safe 5SOLD BYCryptoBilis
Safe 5 is sold by CryptoBilis
- Trezor Safe 5 devicePURCHASED FROMCryptoBilis
The Safe 5 device was purchased from CryptoBilis
- TrezorURGES CUSTOMERS TO MOVE FUNDSCryptoBilis
Trezor urges customers who bought devices from CryptoBilis to move their funds
- LedgerFOUND SPY IMPLANT INCryptoBilis
Ledger found an unauthorized hardware “spy” implant in a device sold by the Southeast Asian reseller CryptoBilis, resulting in losses of about $93 million.
- LedgerHALTED RESELLER SALESCryptoBilis
Ledger halted CryptoBilis reseller sales
- CryptoBilisMINTED TOKENS ONDacity Coin
Cysic Foundation minted 10 million Cysic (CYS) tokens on BNB Smart Chain
- CryptoBilisOPERATESCryptoBilis implant
Cysic Foundation operates the Cysic Bridge
- ChainalysisIDENTIFIED LOSSES TIED TOCryptoBilis
Chainalysis discovered that all confirmed Bitcoin losses were tied to devices sold by the reseller CryptoBilis.
- Ledger's Donjon security teamFOUND IMPLANT INCryptoBilis
Ledger's Donjon security team found an implant in wallets sold through CryptoBilis that reads the 24‑word recovery phrase during setup and sends it over LTE.
- LedgerTIED CONFIRMED LOSSES TOCryptoBilis
Ledger tied all confirmed Bitcoin losses to devices sold by reseller CryptoBilis.
- ChainalysisCLAIMED LINKED TOCryptoBilis
Chainalysis claimed that the theft was linked to CryptoBilis
- Ledger's Donjon security teamDETECTED IMPLANT INCryptoBilis
Donjon security team detected an implant in a wallet sold through CryptoBilis
- CryptoBilisREPORTS HASHRATE FORBinance Pool
Hashrate Index reported Binance Pool’s hashrate as 9.2 EH/s on the date of the article (15 Oct 2026)
- LedgerREQUESTS SUSPEND SALES OFCryptoBilis
Ledger requested reseller CryptoBilis to stop sales and shipments of its devices
- LedgerINVESTIGATESCryptoBilis
Ledger has started an investigation after customers in South East Asia reported they’d lost funds after buying from Malaysia-based reseller CryptoBilis
- CryptoBilisADVISES CUSTOMERS TO CONTACTLedger
CryptoBilis advised customers who bought from CryptoBilis to not set up their devices and to contact Ledger support team
- hardware implantINCryptoBilis
hardware implant is located in CryptoBilis reseller units
- MediaMarktSUSPENDS SALES OFCryptoBilis
MediaMarkt suspends sales of CryptoBilis reseller units
- CryptoBilisSTOPPED SALE OFLedger
CryptoBilis has stopped selling Ledger devices
- CryptoBilisLOCATED INSoutheast Asia
CryptoBilis is located in Southeast Asia
- TrezorNOTIFYCryptoBilis
Trezor notified CryptoBilis that it would be removed from Trezor’s list of authorized entities starting Jan 1 2027
- LedgerADVISESCryptoBilis
Ledger advised CryptoBilis buyers not to set up unused devices
- LedgerSAYS CRYPTOBILIS CEASED SALESCryptoBilis
Ledger said CryptoBilis has ceased all hardware wallet sales
- LedgerISSUES ALERTCryptoBilis
Ledger ISSUES_ALERT CryptoBilis supply chain
- CryptoBilisAUTHORIZED BYLedger
CryptoBilis is an authorized Ledger reseller.
- CryptoBilisSELLSLedger hardware wallet
CryptoBilis sold Ledger hardware wallets that were later involved in tampered‑wallet incidents.
- LedgerDETECTED UNAUTHORIZED CHIP INCryptoBilis
Ledger revealed an unauthorized chip implanted in devices sold by CryptoBilis
- CryptoBilisSUPPLIES DEVICETrezor Safe 5 device
CryptoBilis supplied a Trezor Safe 5 to a customer in August 2026.
- CryptoBilisSOLD ONTokopedia
CryptoBilis sold a Trezor Safe 5 through Tokopedia in August 2026.
- CryptoBilisREPORTS HASHRATE PERCENTAGE FORBinance Pool
Hashrate Index reported Binance Pool’s share as 2.3 % of Bitcoin’s network in December 2025
- CryptoBilisREPORTS HASHRATE FORBinance Pool
Hashrate Index reported Binance Pool’s hashrate as 26 EH/s in December 2025
- Patrick WittPUBLIC VOICE FORCryptoBilis
Patrick Witt served as the administration’s main public voice on the Strategic Bitcoin Reserve
- President Donald TrumpCREATEDCryptoBilis
Donald Trump created the Strategic Bitcoin Reserve
- Ledger hardware walletSOLD BYCryptoBilis
Ledger hardware wallet was sold by CryptoBilis
- TrezorREMOVED RESELLERCryptoBilis
Trezor removed CryptoBilis as a reseller on October 9, 2026.
- LedgerSOLD BYCryptoBilis
Ledger hardware wallets were sold by Southeast Asian reseller CryptoBilis
- LedgerFOUND IMPLANT IN DEVICES SOLD BYCryptoBilis
Ledger’s Donjon security team found an implant in wallets sold through CryptoBilis that reads the 24‑word recovery phrase
- LedgerINVESTIGATEDCryptoBilis
Ledger started an investigation after customers in South East Asia reported losses after buying from CryptoBilis
Relations are facts Graphiti extracted from reports, not verbatim quotes. An end date means later reporting showed the relation no longer holds.
Events 12
- Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 53 cited reports · 2026-10-30
- Tampered Ledger reported in Singapore a month before news broke: Asia Express2 cited reports · 2026-10-30
- How an Attacker Emptied 1,404 Qubic Wallets Without Breaking the Blockchain1 cited report · 2026-10-19
- Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion, Hacken says1 cited report · 2026-10-18
- Ledger CEO and Former Mt. Gox Boss Clash Over $90M Wallet Scandal1 cited report · 2026-10-18
- Who opened your crypto wallet before it reached your hands?1 cited report · 2026-10-18
- What Is a Hardware Wallet? Crypto Cold Storage Explained1 cited report · 2026-10-16
- Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet Users1 cited report · 2026-10-15
- White House Crypto Council Loses Last Staffer: Who's in Charge Now?1 cited report · 2026-10-15
- Here’s what happened in crypto today1 cited report · 2026-10-14
- Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reports6 cited reports · 2026-10-14
- MediaMarktSaturn pulls Ledger products amid tampering reports1 cited report · 2026-10-13
Source reports 25
- Trezor Warns CryptoBilis Buyers After Report of Hardware Implant in Safe 5Decrypt · 2026-10-30
- Trezor warns CryptoBilis buyers to move funds over suspected implantCointelegraph · 2026-10-30
- Trezor reports suspected hardware implant in Safe 5 sold by CryptoBilisThe Block · 2026-10-30
- Tampered Ledger reported in Singapore a month before news broke: Asia ExpressCointelegraph · 2026-10-30
- Tampered Ledger wallets cost Singapore users $2.7M: PoliceCointelegraph · 2026-10-29
- Centralized Exchange and DeFi Losses Dominate 2026 Crypto Hacks Despite Hardware Wallet FailuresBitcoin Magazine · 2026-10-29
- How an Attacker Emptied 1,404 Qubic Wallets Without Breaking the BlockchainBeInCrypto · 2026-10-19
- Crypto audits give investors false sense of security as Q3 hacks cost $1.18 billion, Hacken saysCoinDesk · 2026-10-18
- Ledger CEO and Former Mt. Gox Boss Clash Over $90M Wallet ScandalBeInCrypto · 2026-10-18
- Who opened your crypto wallet before it reached your hands?CryptoSlate · 2026-10-18
- Scammer Lost $4.8M in Bitcoin to Tampered Ledger Wallets: ChainalysisDecrypt · 2026-10-16
- Scammer gets scammed in Ledger spy-chip exploit, loses almost $5 million in bitcoinCoinDesk · 2026-10-16
- What Is a Hardware Wallet? Crypto Cold Storage ExplainedDecrypt · 2026-10-16
- Ledger Says Organized Crime Group Spent Millions Targeting Hardware Wallet UsersBitcoin Magazine · 2026-10-15
- Ledger Announces Atom Touchscreen Android DeviceDecrypt · 2026-10-15
- Bitcoin mining pool once handling 2.3% of network shuts after hashrate falls 65%CoinDesk · 2026-10-15
- White House Crypto Council Loses Last Staffer: Who's in Charge Now?BeInCrypto · 2026-10-15
- Here’s what happened in crypto todayCointelegraph · 2026-10-14
- Trezor reduces resellers as a ‘preventative step’ amid Ledger tampering reportsCointelegraph · 2026-10-14
- Trezor Cuts Its Resellers After Ledger Finds Spy Implant in Crypto WalletsDecrypt · 2026-10-14
- Trezor Reduces Number of Resellers Following Ledger Drainage IncidentBitcoin Magazine · 2026-10-14
- Ledger confirms hardware implant in CryptoBilis reseller units as MediaMarkt suspends sales in EuropeThe Block · 2026-10-13
- Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M DrainDecrypt · 2026-10-13
- MediaMarktSaturn pulls Ledger products amid tampering reportsCointelegraph · 2026-10-13
- Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilisDecrypt · 2026-10-13