GoPlus Security 🚦(@GoPlusSecurity):#Ledger devices bought through reseller CryptoBillis were tampered. Funds deposited on those units were drained. Loss is about $90M. This is not a one-off. GoPlus reminder: buy hardware wallets only from official channels → check the packaging and seal → verify authenticity and activation status on the official site. Wallet makers should also ship tamper-response as standard — including wiping keys if the device is opened — to cut off this class of risk. Main attacker addresses (per Specter and tanuki42): Bitcoin： bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9 bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n Tron： TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9 TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a EVMs： 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a 0x83aeac166f6832ae3500000a24510a95a052a599

2026.10.10 03:36

#Ledger# devices bought through reseller CryptoBillis were tampered. Funds deposited on those units were drained. Loss is about $90M. This is not a one-off. GoPlus reminder: buy hardware wallets only from official channels → check the packaging and seal → verify authenticity and activation status on the official site. Wallet makers should also ship tamper-response as standard — including wiping keys if the device is opened — to cut off this class of risk. Main attacker addresses (per Specter and tanuki42): Bitcoin： bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9 bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26n Tron： TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9 TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a EVMs： 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a 0x83aeac166f6832ae3500000a24510a95a052a599

Ledger Support@Ledger_Support

2026.10.09 13:32

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses. Reach out to Ledger customer support through official channels with any questions: