Ledger: confirmed thefts from devices bought through reseller CryptoBilis
The vendor reports on its channel that all confirmed cases of drained wallets in the October 9, 2026 incident involve devices sold through reseller CryptoBilis in Southeast Asia. This concerns physical substitution or modification of devices on their way to the buyer; the vendor says its own systems and direct sales channels are not affected. The number of affected devices is described as limited, the investigation continues, and affected customers are being notified individually. There is no patch here: the problem is in the supply chain, not the firmware.
If the device was bought from this reseller and is still unopened, do not initialize it. If it has already been set up, immediately create a new seed on a device obtained through an official channel and transfer funds to new addresses; consider the old seed compromised. Contact only the vendor's official support through the link in the post, and remember: the vendor never calls, sends direct messages or asks for your 24 recovery words.
Source: x.com - Ledger