🔐 Ledger says the box was rigged. Nobody says who had their hands on it before you did

Ledger admits one victim's hardware wallet had an unauthorized implant in it. Investigator Specter reckons total losses may top $86M across Bitcoin, Ethereum and Tron. The device came from a third-party reseller, CryptoBilis, which Ledger had listed as authorized in Southeast Asia. Ledger's line: the factory was clean, one reseller went rogue, and the box you unpacked is not the box Ledger shipped. Cute. Very cute.

▪️ The victims bought their Ledger devices from CryptoBilis, an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Authorized, mind you.
▪️ Ledger confirmed that one impacted user's device had an unauthorized hardware implant. Translation: someone physically messed with the hardware before it reached the buyer.
▪️ Specter estimates losses may exceed $86M across Bitcoin, Ethereum and Tron. Ledger hasn't confirmed the number of affected customers or the value of the losses.
▪️ CryptoBilis has stopped selling all hardware wallet inventory until the investigation is concluded. Ledger says it's in active talks with the reseller on next steps.
▪️ Ledger's advice: if you bought from this reseller and haven't run setup yet, don't start it. If you already set up the device, move your assets to a new Ledger signer with a new seed.
▪️ Ledger says its own infrastructure, systems and services were not compromised. Anyone with info can reach its bounty program at bounty@ledger.fr. Good for Ledger's servers.

📊 Reseller countries: 3

If you bought a Ledger from a third-party seller, especially in Southeast Asia, your seed may have been generated on a device someone else had already touched. Ledger's position is that the factory was clean and the problem is one reseller. But the only safe move it's recommending is to abandon the seed on any box you haven't set up yet and migrate funds on any box you have. Nobody has said how many wallets are affected, so the real count is still a guess. Hardware wallet, they said. Sure.

💬 «Ledger's infrastructure, systems and services were not compromised.» — Ledger

🔮 Ledger's servers are clean. So who was holding the box between the warehouse and your desk?

@exverse_chat