Since October 9, a batch of Ledger devices bought from CryptoBilis, a reseller in Southeast Asia, has been found to contain a hardware implant that steals seed phrases. Independent estimates put the losses at around $93 million. Ledger has asked resellers in seven markets across Southeast Asia and Hong Kong to halt sales.
SlowMist (@SlowMist_Team) has found scammers exploiting the news with mass "urgent firmware update" emails that lead to a fake authenticity-check page and then ask victims for their seed phrase.
Where small teams are exposed
Process
Most teams have no rules on where hardware wallets are bought, who receives them and who initializes them. Often employees simply order their own online.
Human factor
When something really has gone wrong and an "official notice" arrives, people under pressure click the link and follow the instructions.
Privileges
If every signer's device comes from the same channel, one bad batch can compromise several keys of a multisig at once.
Five things you can do now
- Buy hardware wallets only from the official store or authorized resellers, centrally, and record their serial numbers
- For devices bought through third parties, replace them, generate a new seed phrase and migrate the assets
- Update firmware only through the official app, and never click links in emails or on web pages
- Make it policy: never enter a seed phrase into a web page, email or chat, under any circumstances
- Source the devices of different multisig signers through separate channels
Loss figures are third-party estimates: Bitquery counts about $93.2 million across 315 wallets. Ledger has not confirmed a total.
Sources
- SlowMist TI alert (2026-10-16) ↗
- BleepingComputer: Ledger asks sellers across Asia to halt sales after supply-chain attack (2026-10-14) ↗
- BigGo Finance: independent loss estimate (citing Bitquery data)
First published on X · Oct 19, 2026: View the original post on X ↗
