Ledger warns CryptoBilis buyers after wallet-draining reports

CryptoBilis buyer precautions

Ledger told CryptoBilis customers on 11 October to leave unused devices uninitialized and, if already set up, move to a new seed on a device obtained from Ledger. The warning follows wallet-draining reports involving the Southeast Asian reseller. A seed is the recovery phrase that provides access to a wallet’s keys; replacing it is central to the company’s advice.

Ledger says all confirmed cases concern CryptoBilis-sold devices and that its own systems and direct sales remain unaffected. It says the reseller has stopped hardware-wallet sales. The update does not quantify losses or explain the attack method. Affected customers are directed to official support and local law enforcement; the investigation continues.

New hardware and existing keys

Ledger’s explanation of its hardware says crypto assets remain on the blockchain. A private key is the secret used to control those assets, while the recovery phrase backs up access to the keys. The hardware stores and protects that secret information; the coins are not files inside its casing.

This distinction makes the words “new seed” consequential. Ledger’s documentation explains that a PIN unlocks a particular device, whereas the recovery phrase remains associated with the underlying keys even when someone changes devices. Entering the old phrase into replacement hardware restores access to the existing wallet. It does not create an unrelated set of keys just because the box is new.

For a buyer following this warning, choosing a new PIN and choosing a new recovery phrase therefore address different things. A replacement device can be physically different while still restoring the same wallet. The decision about which recovery phrase it uses determines that relationship.

Keep the replacement setup and recovery backup private

Ledger’s general security guidance says the recovery words should be generated during the owner’s own device setup. It warns against preconfigured devices and supplied recovery phrases. That principle helps explain what a fresh setup is meant to accomplish: the owner creates the new wallet credentials, instead of accepting a set that someone else may already know.

The same guide says to keep the recovery sheet private and offline. Photographing it, entering it on a computer or phone, or sharing it gives the words additional places to be exposed. A request to type a recovery phrase into a web form would conflict with those instructions. A support conversation should never require handing over the wallet’s recovery words.

Receiving addresses need a separate check. Ledger’s guide instructs users to compare the address in the wallet software with the address displayed on the receiving hardware. The purpose is to catch a substituted destination on the computer. These are general setup precautions for the replacement; they are not a finding that any particular CryptoBilis device passes inspection.

Moving balances requires transfers, rather than a restore

Ledger’s migration documentation describes the other half of changing wallet credentials: after creating fresh accounts, assets must be sent to their new receiving addresses. It contrasts this with importing an existing recovery phrase, which reproduces access to the old accounts. Simply opening a replacement device and seeing the old balances does not mean those balances have moved to new keys.

That guide concerns moving from a software wallet to hardware, so it should not be read as a forensic explanation of the CryptoBilis incident. Its relevant lesson here is the difference between restoring credentials and transferring assets. The instructions also acknowledge network transaction fees. There is no universal transfer price in that documentation; the cost should be checked for the proposed transaction rather than assumed to be zero.

The practical question is consequently where each balance is controlled after the change. Restoring an account and transferring its assets are separate operations, even if a wallet interface presents both as ways to get started on a new device.