Ledger CryptoBilis update names no window or serial ranges

Ledger's Oct. 11 update on X ties every case confirmed to date from the Oct. 9 draining incident to devices sold through CryptoBilis, a Southeast Asia reseller. If you bought your Ledger elsewhere, the update gives no purchase window, no serial or order ranges and no way to check your seller. It sends owners with concerns to Ledger Support instead.

The earlier advice had a time limit. Ledger's Oct. 9 advice covered people who bought from the reseller in the previous 90 days, YFarmX and Bitquery report. The Oct. 11 update states no purchase window.

A Ledger list of affected serial or order ranges would settle whether your device is in scope. For money already stolen, the only freeze on record is Tether's block of about 10 million USDT on Oct. 9.

CryptoBilis buyers get two steps from Ledger

Ledger's Oct. 11 update sets two steps for CryptoBilis buyers. The guide to setting up a cold wallet walks through the fresh setup the second step requires.

Direct sales are the channel Ledger calls unaffected

On Oct. 10, Ledger Support confirmed an unauthorized hardware implant in one impacted user's device. As of Oct. 11, it is the one implant Ledger has confirmed publicly. In the same post, Ledger said it had no indication its security infrastructure, systems or services were compromised. On Oct. 11 it called its systems and direct sales channels unaffected and the volume of impacted devices limited, without a count.

The Oct. 10 statement describes Ledger's security infrastructure, systems and services; the Oct. 11 statement describes its systems and direct sales. Direct sales are the devices Ledger sells itself, through its official shop. If you bought there, yours is the channel Ledger calls unaffected. A device from another reseller or a marketplace falls outside both statements.

Your purchase date is a weak guide

Bitquery's wallet data puts the reported 90-day window in proportion. About 6 in 10 TRON, Bitcoin and Ethereum victim wallets first received funds inside it. More than 8 in 10 did so from June onward. That leaves about 4 in 10 first funded before the window opened.

A first deposit marks when a wallet came into use. That is a different date from when its owner bought the device. The date on your receipt is therefore a weak guide on either side of the window.

Set against Ledger's account of its own systems, Bitquery reads the on-chain record as pointing to one actor who held the keys to every drained wallet. How each key leaked is the part the chain cannot settle.

Freezes hold stablecoins in place

The Tether freeze covers 10,000,001.11 USDT in 20 of the thief's wallets. Tether blocked 37 addresses on Oct. 9 and released four of them. The freeze stood unchanged late on Oct. 11.

A block keeps the coins in place, inside the thief's wallets. Tether can later destroy blocked coins and reissue them, Bitquery notes.

Circle's USDC was the second chance to freeze funds, and that window mostly closed on Oct. 11. At about 06:00 UTC that day, Bitquery counted 5.35 million USDC in five wallets Circle could freeze. By 22:24 UTC, YFarmX found 710,428 USDC left in one freezable wallet, about 13% of the morning amount. No Circle freeze appears in YFarmX's 12:48 UTC read or in the PublicAML trace of the two USDC wallets from Oct. 9.

Bitcoin sits outside any issuer's reach. About 203.8 BTC sat unmoved in the thief's two main Bitcoin drain addresses as of 22:24 UTC on Oct. 11. With no issuer to freeze them, these coins can move whenever the thief chooses.

One live approval let the thief take more after the drain. An approval is a permission a wallet signs that lets another address move a set token out of it. On Oct. 10, 70,000 USDT reached an already drained TRON wallet. About 10 minutes later, the thief pulled it out with the approval the victim had signed Oct. 9.

On Oct. 10, YFarmX followed two payments of about $50 each into a Binance deposit address. The sender was a Zcash-exit wallet, which received coins after they passed through the privacy coin Zcash.

Bitquery and YFarmX say Binance can identify the accounts the traced deposits credited. As of Oct. 12, reports carry no Binance freeze, return or comment.

CryptoBilis has stopped selling hardware wallets

The Oct. 11 update also tells users to avoid unauthorized resellers, citing the risk of suspicious, counterfeit or modified devices. CryptoBilis itself sat in Ledger's reseller finder. By Oct. 11, the finder showed its sales as temporarily paused for Malaysia and Indonesia, YFarmX reports. The Philippines entry it carried on Oct. 9 was gone.

CryptoBilis has confirmed to Ledger that it ceased sales of all hardware wallet inventory until the investigation is concluded. Ledger is reminding its authorized resellers and distributors to source products only through authorized channels. It also tells them never to restock returned products.

Ledger's two steps for CryptoBilis buyers are the instructions on record as of Oct. 11. Watch three checks: Ledger's next update for any serial or order ranges, a Binance response on the traced deposits and the two Bitcoin drain addresses.