> be ledger.
> work with cryptobilis. authorized reseller.
> except the box that are send are not the box that left the factory.
> someone in that chain opens it and plants a second board.
> the secure element is left alone on purpose. genuine check still says yes.
> the implant is on the display line, the spi bus, and listens.
> when you set the device up, the 24 words scroll on the screen.
> the bug reads the button presses, rebuilds the phrase, and ships it out over lte.
> the device sent you seed phrase to someone else.
result: someone has your seed. they wait until the balance is fat, then sweep btc, eth, and tron from a wallet they control.
on-chain trace today: about $87m sitting across 98 addresses labeled ledger user theft. 16.8k eth, 211 btc, plus usdt and usdd.
ledger has confirmed the reseller. sales paused. if you bought from cryptobilis in the last 90 days, do not even turn it on. if you already did, the seed is burned. move what is left to a new device and a new phrase you generated yourself.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.
Reach out to Ledger customer support through official channels with any questions: