A report stated that a Ledger official distributor was hit by a supply-chain attack. The attackers allegedly implanted hardware modules to steal the recovery phrase displayed on the device screen, causing approximately 90000000 USD in crypto-asset losses.
Company records show that Jiaming has held all shares in CryptoBilis since August 3; former co-founder says the company March was acquired. CryptoBilis has suspended hardware wallet sales and shipments in Southeast Asian countries.
CZ Reminded Ledger users to beware of counterfeit or tampered devices and said the incident currently appears to involve only one distributor. Ledger had previously investigated reports of user funds being stolen in Southeast Asia.
Bitget says the attacker exploited a vulnerability in a third-party security product to obtain internal network credentials, while private keys and cold-wallet assets were unaffected; Mandiant and SlowMist have joined the review.