Ledger reportedly narrowed the confirmed cases in its October 9 hardware-wallet draining incident to devices sold by Southeast Asian reseller CryptoBilis. Separate reporting says the company may have received warnings about device tampering as early as December 2025. The central question is now less about whether at least one device was implanted and more about whether earlier alerts should have prompted wider customer warnings sooner.

Ledger’s Reported Position on the CryptoBilis Incident

Media excerpts from CoinDesk and Help Net Security say Ledger’s follow-up updates linked confirmed cases from the October 9 draining incident to devices sold through CryptoBilis. The same excerpts say Ledger confirmed that one affected user’s device contained an unauthorized hardware implant and characterized the number of confirmed affected devices as limited.

Within that reported scope, Ledger also said its internal systems and direct-sales channels were unaffected. This frames the company’s current position as a reseller-specific supply-chain issue tied to confirmed October 9 cases, rather than a proven compromise affecting all Ledger devices or sales channels.

The flash also says Ledger launched an internal investigation. In the same reported update sequence, CryptoBilis was said to have suspended hardware-wallet sales while the investigation continued.

What the Reported Timeline Shows

Attribution-based reporting places potential earlier warnings well before the October public incident. The supplied flash attributes to Mark Karpelès a claim that at least two people began contacting Ledger about device tampering in December 2025. It also says security researcher Joe Grand reported a suspected malicious implant to Ledger on March 4, 2026, after examining a Nano X tied to a Lazada Thailand purchase.

A Zetter-Zeroday search excerpt supports the reported March 2026 disclosure timeline and says Grand examined additional Nano X devices bought from online sellers in Thailand. However, this earlier-warning timeline is not accompanied here by a reviewed primary Ledger statement directly addressing those contacts. It therefore does not establish that Ledger ignored or mishandled the reports.

Nor does it prove that the Lazada Thailand devices and the later CryptoBilis-linked October cases were part of the same attack chain, used the same implant version or came from the same supply source. Ledger’s reported CryptoBilis scope is narrower. The available evidence therefore supports two separate points: earlier tampering claims may have reached Ledger months before October, while Ledger’s reported confirmed-case statement remains specific to the October 9 incident and CryptoBilis-sold devices.

What Is and Isn’t Covered by the Current Reporting

The most useful interpretation for customers is a narrow one. The reported confirmed-case group concerns devices sold through CryptoBilis in connection with the October 9 draining incident. It is not a blanket clearance for devices from other third-party sellers, nor does it prove that all other marketplace cases are part of the same incident.

This distinction matters because current reporting identifies both CryptoBilis and a separate Lazada Thailand purchase channel. Without a direct Ledger statement linking those channels, or definitively separating them, readers should not treat the October update as either a universal all-clear or confirmation that every regional reseller or Nano X unit is affected.