I take the alleged Ledger tampering seriously because a customer could follow the setup instructions correctly and still receive a compromised device. Cyber Scrilla describes an ongoing investigation involving reseller CryptoBilis, with reports that malicious hardware was added to otherwise genuine wallets.
What the Ledger wallet security reports establish
Some affected users reportedly said their wallets were emptied even though they had never entered their recovery phrase elsewhere and had used the wallets only to receive crypto. The creator cites those accounts as a reason to investigate physical tampering rather than assume that each owner approved a fraudulent transaction or disclosed a phrase online.
The reported loss figures differ. I would keep them separate rather than treat the largest as a confirmed total.
| Source | Reported amount | How to read it |
|---|---|---|
| CoinDesk headline | $86 million | Reported losses associated with the investigation |
| Post by Specter | $86M+ | Investigator's reported total |
| Creator's opening statement | More than $90 million | Allegation presented in the commentary |
According to the creator's account of Ledger's initial response, Ledger asked CryptoBilis to stop selling its products and warned recent buyers not to set up affected wallets. A Ledger Support post concerns reports of losses from users in South East Asia who bought products from the reseller.
Those warnings warrant caution, but they do not establish that every device sold by CryptoBilis was affected or that Ledger's security chip was defeated. The investigation remains ongoing, and responsibility for the reported losses is uncertain.
How a reseller becomes part of the attack surface
An authorized reseller has a manufacturer's permission to sell its products. Hardware wallets can travel from the manufacturer to that retailer, which stores them before shipping them to customers. That adds a business between the factory and the buyer.
A supply chain attack exploits this route before the customer starts using the device. In the alleged attack, someone adds malicious hardware and sells the wallet as an ordinary unit. I find this distinction important: protecting a recovery phrase from websites cannot prevent a hidden component from capturing it inside the device.
A reseller's authorization confirms a commercial relationship, not the physical condition of every unit throughout storage and delivery. That limit does not make every retailer suspect, but it explains why an authorized seller's stock can still require investigation.
CryptoBilis also lists hardware wallets from other manufacturers. The creator raises concerns about the reach of a multi-brand retailer, although the allegations concern modified Ledger devices. I would not extend the accusation to other products merely because the same business sells them.
How the alleged implant could capture a recovery phrase
Mark Karpelès, the former CEO of Mt. Gox, reportedly examined modified Ledger devices containing hidden SIM cards. According to his findings as relayed by the creator, an implant could read information sent to the wallet's screen, then capture and transmit the recovery phrase when it appeared during setup.
A recovery phrase, also called a seed phrase, lets wallet software restore the private keys that authorize transactions. Someone who obtains it can generally restore control of the wallet elsewhere without possessing the original hardware device. A receiving address lets others send funds in; the private keys let their holder send funds out.
That mechanism helps explain why receive-only use would not necessarily prevent theft. An attacker with the phrase could authorize transactions from a separately restored wallet without asking the legitimate owner to approve them. I would still treat this as a plausible explanation, not a diagnosis of every reported loss.
The alleged implant targets the screen connection, where the owner expects to review sensitive information within trusted hardware. It would not require the owner to type the phrase into a browser. Receive-only use describes the owner's activity, but cannot establish who saw the backup or whether another route exposed it.
Why a genuine check may answer a narrower question
Karpelès reportedly found that the modifications left Ledger's security chip intact, allowing an altered device to pass the app's official genuine check. Authenticating that chip is different from detecting unexpected hardware elsewhere in the enclosure.
I would read a successful check for what it measures. It can confirm an expected component without inspecting every wire or connection around it. That makes authentication useful, but narrower than a complete physical inspection.
Karpelès also reportedly examined a modified wallet from Malaysia whose packaging looked new and was shrink wrapped. He found the suspicious hardware after opening the device. An intact-looking box cannot establish what is inside, just as unfamiliar packaging alone cannot prove that a wallet contains an implant.
The creator suggests opening a device and comparing its internals with authentic examples. I would not turn that into a general instruction: opening hardware can damage it, and an untrained inspection may create false confidence. For a device covered by a warning, verified manufacturer guidance is a better starting point than a teardown.
Ownership allegations need evidence of responsibility
The creator reports that CryptoBilis was sold to a Chinese company. A post discusses shareholders, while another from Arravind Prabu says contract confidentiality restrictions applied until October 19. The creator interprets the timing as evidence that the alleged tampering may have been planned around the purchase.
An ownership change and a confidentiality agreement do not, by themselves, identify who installed an implant or prove that a buyer acquired the business intending to attack customers. I would not treat a buyer's or shareholder's nationality as evidence of wrongdoing. Responsibility depends on evidence about control of inventory, access to devices and connections between particular hardware and losses.
The creator also cites earlier reports of modified Ledger devices arriving unsolicited in the mail. Those reports show that physical manipulation is a recognized attack concept, but do not connect the earlier scheme to the current allegations through an operator, design or distribution route.
The video provides no verified forensic link between the alleged implants and the full reported loss total.
I would separate the immediate purchasing warning from the theory about motive. Buyers can act cautiously on a warning about a particular channel while investigators establish who was responsible.
Fake websites and apps create a separate threat
The creator reports finding a sponsored search result that appeared to be associated with Ledger but led to a fraudulent website. It asked visitors to select a device, presented a connection sequence, then requested a recovery phrase or offered to create one.
That sequence makes a dangerous request look like routine setup. A familiar product name and a convincing connection screen are not proof that the destination belongs to the company. I would check the request before trusting the design: entering a recovery phrase exposes the credentials needed to restore the wallet. Accepting a phrase from an untrusted website is also unsafe because its supplier may already know it.
The creator reports a similar app-store scam. After the user pressed a connection button, an app presented as Ledger-related requested a recovery phrase. The creator cites a user's report of losing $600 to it; that remains a reported individual loss.
Neither an app-store listing nor a sponsored placement guarantees authenticity. In these examples, scammers seek the backup secret without touching the hardware wallet.
I would distinguish a connection request from a request for the recovery phrase. Legitimate crypto applications can ask to connect a wallet, so that alone does not prove fraud. An unexpected verification flow deserves scrutiny, but disclosure of the phrase is the clearer warning. Read what the site asks you to authorize.
What buying directly can and cannot change
The creator recommends ordering from the manufacturer's official website because each additional stop creates another opportunity to interfere with a device. Buying directly removes a reseller from that route; it does not make every part of delivery risk-free or prevent later credential theft.
I see direct purchasing as one precaution alongside authentic software and careful handling of the backup. The creator considers devices bought from a manufacturer's official Amazon store probably safe, but personally recommends direct orders. That assessment is not a finding about any particular marketplace purchase. The seller's identity matters separately from the marketplace name surrounding a listing.
The creator also argues that Tangem's sealed card would be harder to alter in the same way: adding a SIM card would require destructive interference. They say its app checks whether the chip's firmware is authentic and displays a warning if the check fails. Firmware is software embedded in a device, so that check addresses a specific technical question rather than every possible attack.
I would compare these protections by asking what each checks. A sealed design, a chip-authentication result and a verified seller identity provide different information. None establishes immunity from tampering or fraud, and a different physical design does not remove the fake-website threat.
Reaching the official website safely also matters. The fraudulent search result illustrates how someone seeking a manufacturer can be diverted before ordering or downloading software. Check the actual site address rather than relying on a familiar name or the result's position.
Preserve evidence before troubleshooting a suspect device
If your purchase matches the reseller warning, pause before setup and seek instructions through a verified manufacturer support channel. Repeated setup attempts cannot establish whether the internal hardware is trustworthy.
For an already configured wallet, I would preserve the information needed to investigate. Keep order records and correspondence, but never include the recovery phrase in a support message. Purchase details can help establish what happened without exposing the secret that controls the wallet.
Use these general incident-handling steps, rather than treating them as a device-specific repair procedure:
- Save your purchase confirmation and the seller's identifying details.
- Record any unexpected behavior without including recovery words or other secrets.
- Contact manufacturer support through an independently verified channel.
- Keep the device and its packaging available for any inspection the manufacturer requests.
- Treat unsolicited offers of wallet recovery or verification as untrusted until you establish who is behind them.
If a balance is missing, investigate the wallet addresses and transaction history rather than entering a phrase into a recovery service. Public receiving addresses and transaction records can describe a problem without revealing spending credentials. Sharing them publicly can still expose financial activity, so consider privacy before posting them.
I would resist rushed instructions to reset, dismantle or discard the wallet. Follow verified support guidance on what to preserve: those actions can change the evidence an investigator is able to examine.
