Independent public-interest resource — not affiliated with Ledger SAS, CryptoBilis, or any retailer. We will never ask for your recovery phrase or private keys.
Timeline
August 2025 → present. Every entry carries a label:
documented preserved primary evidence ·
reported community/press statement, unverified ·
open unresolved question. Dates marked "~" are
approximate.
~Aug 2025 — Suspected
start of the implant insertion window. Where in the supply chain the modification was
introduced (contract manufacturer, regional distributor, in-transit interception)
remains unresolved.open
Aug 2025 → Oct 2026 — Implanted
devices ship through third-party retail: CryptoBilis (MY/SEA web + stores), Shopee,
Lazada, Amazon JP, Yahoo Auctions JP, Metapod (Changi Airport), an EU reseller, and
MediaMarkt Saturn (DE). Purchasers set up devices normally; the implant exfiltrates
the displayed recovery phrase over its own LTE/eSIM radio.reported
Oct 2026 (early) — Victims
begin reporting drained wallets seeded on brand-new devices. Pattern recognized:
losses cluster by retail channel, not by user behavior.reported
Oct 9, 2026 — Incident
disclosed publicly; hardware teardown reports identify the LTE/eSIM implant reading the
screen during seed setup. Community tally begins: ~311–530 wallets, ~$72–103M
drained.reported
Oct 2026 (mid) — Tether
freezes ~$10M USDT of identified drain proceeds. Freezes trace to rapid victim reports
filed with exchanges, issuers, and police.reported
~Oct 19, 2026 — CryptoBilis
expected to issue a public statement on affected stock and customer handling
(reported; verify against the retailer's own channels).reported
Present — Vendor batch/serial
ranges not yet published. Affected device count, total loss, and the insertion point in
the supply chain all unresolved. Lawsuits and regulator action anticipated but not
confirmed.open
What to watch
Vendor (Ledger) official advisory and affected-batch publication — watch support.ledger.com, not social posts.