Ranjit Singh retweeted
YOUR LEDGER IS COMPROMISED ❌
Here’s everything we know about the hack.
You should know it too :
🔴 WHAT HAPPENED
On Oct 9, wallets across Southeast Asia (mostly Indonesia, Malaysia, Philippines) started getting drained. Hundreds were swept within seconds of each other.
On-chain sleuths like Specter and tanuki42 traced the funds within hours. The pattern: all victims bought their Ledger from the same seller, CryptoBilis, a listed authorized reseller for those markets.
Ledger asked CryptoBilis to pause all sales and shipments the same day.
🔴 HOW THE HACK WORKS
On Oct 10, Ledger confirmed it: a hardware implant was found inside an affected device. Not a software bug. Someone physically opened genuine Ledgers and added a spy circuit.
The implant reportedly has:
- a microcontroller
- an LTE module + eSIM + antenna
- placement where the screen padding normally goes
It taps the line between the secure chip and the display. When you set up the wallet, your 24 words show on screen, the implant reads them and sends them out over cellular. No Wi-Fi or USB needed.
The secure chip is untouched, so the device still passes Ledger's Genuine Check. Packaging can look fully intact. Researchers (incl. Mark Karpelès via Tibane Labs) found multiple implant generations, newer ones smaller and harder to spot.
🔴 THE DAMAGE (third-party estimates)
Bitquery: ~$93M-$102M across 315+ wallets
YFarmX: ~$103M across 530 addresses
Biggest chunk: ~$79M USDT on TRON
The attacker was patient: weeks of small test transactions before the big sweep.
Funds moved through Tornado Cash, Zcash shielded pools, THORChain and USDT to USDD swaps. Tether froze ~$10M. Some USDC may still be freezable by Circle.
🔴 LEDGER'S POSITION
- All confirmed cases trace back to CryptoBilis
- Calls the volume "limited"
- Says its own systems and direct sales were not compromised
- No official loss figure yet
CryptoBilis has stopped selling hardware wallets. OneKey also revoked its authorization.
🔴 STILL UNCONFIRMED
Users in Europe are posting photos of similar implants, with several claims pointing to MediaMarkt stores in Germany. Some of those devices had no funds drained, and Ledger hasn't linked them to this attack. Treat as reports under investigation.
🔴 WHAT TO DO
Bought from CryptoBilis in the last ~90 days?
- Don't set up an unused device
- Already set one up? Move funds to a new seed on a new device, ideally bought direct from Ledger
Expect scammers. Ledger will never call you, DM you, or ask for your 24 words.
🔴 THE LESSON
Your hardware wallet is only as safe as the chain of hands it passed through. Buy direct when you can. When you can't, know exactly who your seller is.
Image credits: @0xJohannes_
Ranjit Singh retweeted
Ledger 自己承认，芯片认出了屏幕上的 24 个助记词
欧洲最大的消费电子连锁之一 MediaMarkt，今天把货架上全部 Ledger 产品端走了。下架的不是某个批号，是整条产品线，因为德国门店卖出去的两台 Nano X 被拆开后，里面都多了线缆和一块疑似 LTE 模块。
这事前几天还被当成东南亚一家经销商的意外。Ledger 确认被动过手脚的设备全来自 CryptoBilis 这家东南亚授权经销商，马来西亚、印尼、菲律宾三地，官方口径里只验证出一台机器里有未授权植入物。
所以 Ledger 今天把手法摊开讲了。那颗多出来的芯片藏在设备外壳里面，用户第一次初始化、屏幕上亮出 24 个恢复短语的那一刻，芯片里的微控制器就把这些词认出来、解码，然后通过一张 eSIM 走 LTE 移动网络发了出去。
24 个词就是钱包的总钥匙。谁拿到，谁在别的电脑上把钱包重建一遍，币就搬走了，你那台机器连都不用连。Ledger 还特意说了一句，安全芯片没动，系统没动，签名也没动，就是货在路上被人开壳塞了东西。
但德国这边根本不是东南亚的货。@0xJohannes_ 是个德国用户，他在 MediaMarkt 门店买了台 Nano X，拆开发现里面多了线缆和一个疑似 LTE 模块。自己都不信，10 月 12 日又跑去另一家 MediaMarkt 门店买了第二台，全程录开箱视频。
我把那段视频翻出来看了，画质糊得厉害，他从店里拿着全新机器出来，当场撬开，还是那几根多出来的线。两台，两家店，全中。他点名中间那一环是经销商 Aqipa，Ledger 的 CTO 自己也说不清 Aqipa 算不算直接经销商。
也就是说，脏货不只在一家经销商的仓库里。新加坡樟宜机场 Metapod 店卖的一台 Ledger Flex，买家 Ben Yorke 看外壳有划痕送去检测，门头沟前 CEO Mark Karpelès 拆开发现里面多塞了一块电路板，这机器一次都没用过。日本从 Amazon Japan、Yahoo Auctions 收来的部分 Nano X 也有植入。10 月 11 日还出了第一例 Stax 的植入报告，里面是 4G/LTE 模块加隐藏天线。
两台德国门店的货都验出同样的东西，MediaMarkt 母公司索性把全部 Ledger 下了架。正规电器连锁里塑封好的那台冷钱包，现在也没人敢保证它是原装。
Ranjit Singh retweeted
Dear Prime Minister Ambani,
Please accept my humble apologies for not realizing that you are the real boss of India.
Naturally, you would prefer to maintain your monopolistic exploitation of the great people of India, but would you nonetheless consider allowing Starlink to compete?
There are many areas of India, as there are in all countries, with no Internet access, which denies children the opportunity for education and for small businesses the opportunity to sell their goods to a global market. Starlink would change their lives for the better.
Thank you 🙏
Ranjit Singh retweeted
oh my god this is worse than we thought
here's @Ledger $86M exploits explained
> cryptobilis was a reputable and authorized Ledger/Trezor/OneKey dealer for over 4 years
> they decided to sell the company to a Chinese guy (most likely patsy for DPRK) from northern China in MARCH 2026
> the "Chinese guy" modded the devices within the supply chain itself (physical), namely Nano X devices, to contain an implant module
> ledger validity/genuineness check CANNOT detect this because hw wasn't actually tampered with, just spied on
> quoting @MagicalTux:
" implant just monitors what's shown on the screen, will take note of the seed as it's shown to you, then transmits it to 3rd party"
> former owner chimes in on X (pic below) to say that "they were under a NDA" to not mention anything to anyone for 6 months
> they obviously didn't alert any of their partners that they were authorized to sell devices of... because NDA, duh!! its in the name!
> conveniently, funds start getting siphoned a few weeks before this magical NDA due date, and being laundered across all blockchains
Ranjit Singh retweeted
Tax She and Modi Govt increased.
> LTCG from Zero to 12.5%
> STCG from 15 to 20%
> STT from 0.05% to 0.15% in F&O
> Debt funds indexation removed and taxed at slab rate that is as high as 39%
> SGB secondary market taxed
> 10% Surcharge introduced at 50L from 1cr
> Dividend taxed at slab rate
> PF interest above 2.5L taxed at slab rate
> Health and education cess increased from 3% to 4%
So better you don't talk about your work. No one should be proud of the lies and incompetency.
Ranjit Singh retweeted
Most Corrupt Department in India
1. Police - 72%
2. GST - 71%
3. Panchayat - 69%
4. Labour /PF - 69%
5. Sub Registrar - 68%
6. RTO - 59%
7. Municipality - 57
8. Income Tax - 47%
9. Electricity - 41%
10. Custom - 38%
Ranjit Singh retweeted
she lost her puppies, but found a reason to smile again in this classroom 🥺🤍
holding small hands to mend a broken heart 🐶
Ranjit Singh retweeted
This little dog was adopted and was so happy on his first day in his new home that he couldn’t even sleep. He kept trying to lie down, but his tail wouldn’t stop wagging
Ranjit Singh retweeted
🚨#BREAKING: Outrage is erupting in Houston after a mother just SH0T and K*LLED her OWN DAUGHTER instead of handing her over to the girl's father after losing custody...
...and the court had ruled she couldn't even be ALONE with that child!!!
The girl went home with her anyway and the mother k*lled her.
Yes, you read that right.
The court itself decided this mother could not be trusted alone with her child. And then her child went home with her, alone, anyway.
Her name was Vivian Savella. She was 4 years old.
Her family says she was "loved without limit."
On Tuesday, September 29th, there was a custody hearing in Houston.
Vivian's father, Aaron, had spent that whole case doing it the right way.
In his family's words: "He trusted the courts. He followed every order. He waited for the process to work."
And on Tuesday, it finally did.
A judge gave Aaron primary custody of Vivian... the right to decide where she lived, her medical care, her schooling.
The mother? Court documents say she was "awarded possession of the child only when continuously supervised."
Vivian was supposed to be handed over to her dad that night.
She never made it.
...but it gets worse
According to the father's attorney, the court never spelled out HOW that handoff was supposed to happen.
The supervision was supposed to come through a court-appointed agency, but the ruling had JUST come down... and no supervisor was with Vivian and her mother that day.
So after the hearing, police say, Vivian and her mother went home. To the same townhome on Terra Reserve Place.
Her stepfather and a babysitter were downstairs.
Just before 6 that evening, they heard gunshots from the third floor.
They forced their way into Vivian's room.
Her stepfather tried CPR.
Vivian didn't make it.
Her mother had SH0T herself too.
She later passed away at the hospital.
A judge put it in writing that this mother could not be alone with Vivian.
Hours later, she was.
And now a father who did everything the law asked of him is burying his little girl.
Say her name. Vivian Savella.
WE DO NOT HAVE TO LIVE LIKE THIS!!!!!!!
Ranjit Singh retweeted
Yol kenarına terk edilen bu köpek, kendisine sevgi gösteren kadınlara sanki yaşadıklarını anlatıyor. Ardından yaşananlar ise izleyenleri duygulandırıyor. 🥹🐾
Ranjit Singh retweeted
O cachorro estava desaparecido há 2 dias, e esta é a reação do gato quando ele finalmente é encontrado🥺