> ## Content Index > Fetch the complete content index at: https://www.dailyferment.com/llms.txt > Use this file to discover other available public pages before exploring further. # Ledger's genuine check passed. Nobody checked who owned the shop. - URL: https://www.dailyferment.com/ledger-cryptobilis-implant-reseller-change-of-control/ - Published: 2026-10-13T16:00:00.000Z - Updated: 2026-10-13T16:00:00.000Z - Description: Tampered Ledger wallets passed Genuine Check because the chip inside was real. The reseller that sold them had changed owners months earlier. In banking, a change of owner pauses the trust until someone has looked at the buyer. - Author: Rana Bilal Zafar - Tags: Where Systems Meet People, Security, Fintech, #reframe On 10 October Ledger confirmed that a wallet belonging to one affected customer contained an unauthorized hardware implant, Bitcoin.com News reported. People in Southeast Asia had been reporting drained wallets since the 9th. A day later Ledger said "all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis", as Help Net Security quotes it. CryptoBilis is based in Malaysia. Ledger says its own systems and direct sales channels weren't compromised. On-chain researchers put losses above $93 million. Ledger hasn't confirmed a figure. The detail that stopped me was in the same Help Net report. Mark Karpelès, who says he bought one of the tampered devices in Malaysia, said it arrived in intact shrink wrap and passed Ledger's Genuine Check. So the question I want to answer is this: if the device passed the check and came from a reseller Ledger had authorized, what was anyone actually checking? ## My first reaction was that Ledger's hardware had failed That was wrong, or at least it isn't what the evidence shows so far. Karpelès says the implant was a small board under the screen, with a microcontroller, an antenna, an LTE chip and an eSIM. In his words, "the implant just monitors what's shown on the screen." A Ledger shows your recovery words on its display during setup. The board reads them there and sends them out. With those words an attacker can rebuild the wallet anywhere and empty it later. The secure chip, the part Ledger designed to keep the keys safe, was never touched. That's why Genuine Check passed. It asks the chip to prove it's real, and the chip was real. The check did exactly what it was built to do. It just wasn't built to notice a second board sitting next to the chip. So the hardware held. What failed was the reason a buyer trusted that box in the first place: it came from one of Ledger's own resellers. When Ledger reminded resellers of the rules, it addressed them as "our authorized resellers and distributors", Help Net Security reports. ## The shop had changed hands CryptoBilis's former co-founders said they handed over administrative, operational and system access to new management after a sale that closed in March 2026, The Crypto Times reports. Company records reported by BlockBeats show a single individual holding 100% of the shares since 3 August. The founders said an NDA had kept the sale quiet. I want to be careful here. There's no evidence yet that the new owner had anything to do with the implants. Changpeng Zhao claimed the attackers had apparently bought the reseller, but The Crypto Times notes that no evidence cited so far shows the buyer was involved. The timing is what matters for my question, not the blame. Bitquery found that more than eight in ten of the drained wallets first received funds in June or later, which is after the sale. AirdropAlert made this point on 10 October: Ledger "apparently missed the change of control too." I think that's right. An authorized-reseller badge describes a company at the moment it was granted. It says nothing about who owns it now. ![Three boxes: Genuine Check passed because the secure chip was real; the authorized reseller status was still trusted; nobody checked who owned the shop after its sale in 2026](https://storage.ghost.io/c/d7/b7/d7b77195-48c5-45ab-8688-51750879d1d6/content/images/2026/10/df45-owner.png) Genuine Check looks at the chip. The reseller badge looks at the company as it was. Sources: Help Net Security, The Crypto Times, FDIC. ## The cross: a bank can't change owners quietly Banking has dealt with exactly this. A bank licence, like a reseller badge, is given to a company. But in the US you can't buy control of an insured bank and tell the regulator afterwards. Under the Change in Bank Control Act, as the FDIC's procedures manual sets it out, nobody may acquire control of a covered bank without giving the FDIC at least 60 days' written notice first. Control means the power to direct the bank or to vote 25% of a class of its voting shares, and the FDIC presumes it from 10% in some cases. During those 60 days the regulator looks at the buyer, not the bank. One of the statutory factors is the "competence, experience, or integrity" of the person buying. If those suggest it wouldn't be in the interest of depositors or the public, the FDIC can say no. Each person filing must submit an FBI fingerprint card. The logic is simple. The bank's systems didn't change on the day of the sale. The vault is the same vault. What changed is who decides what happens inside it. So the trust the licence carried is paused until someone has looked at the new owner. ## What that suggests for sales channels Apply that to CryptoBilis. The devices and the shop looked the same on 4 August as on 2 August. The person who controlled stock, returns and shipping might not have been. A rule borrowed from banking would say the badge goes on hold when the owner changes, until the new owner has been looked at. Ledger is already moving toward the channel. It told resellers "to source products only through authorized channels and never to restock returned products", as Help Net Security quotes it. That's about where the boxes come from. It isn't about who runs the shop. For buyers there's a simpler version: the safest channel is the one with no owner in between. Ledger told affected users to move their funds to a new device with a new seed, and Help Net Security reads that as a device bought directly from Ledger. ## Where the comparison breaks A bank regulator has the law behind it, and a bank holds other people's money every day. Ledger is a private company with resellers in many countries, and it can't fingerprint anyone. It may not even be told when a reseller is sold. I don't know what Ledger's reseller contracts say about a change of owner. The bigger problem for my argument is Europe. A researcher reported a tampered device bought from MediaMarkt, a large retailer, The Crypto Times reports. Ledger hasn't confirmed it's linked. If it is, then the attack didn't depend on one shop changing hands, and an ownership check alone wouldn't have stopped it. The deeper fix would be a check that can see the whole device, not just the chip. I wrote before about [HSBC's device-integrity check blocking phones](https://www.dailyferment.com/hsbc-blocks-private-space-secure-folder-device-integrity/) because it couldn't tell a privacy feature from an attacker. This is the same problem the other way round: a check that passes because it only looks at the part it was built to look at. And the [registry hijacks that produced real Google certificates](https://www.dailyferment.com/cctld-registry-hijack-google-certificates/) worked the same way, real credentials from a record someone else now controlled. ## What I'm confident of, and what I'm not Ledger's statements, the Genuine Check result Karpelès described, and the change of ownership are established from Ledger's posts as reported by Bitcoin.com News, Help Net Security and The Crypto Times, and from records reported by BlockBeats. The bank rule is established from the FDIC's manual. That a review on change of owner would have caught this is inferred, and nothing yet ties the new owner to the implants. That hardware makers will start checking who owns their resellers is a guess. The claim, in one sentence: an authenticity check proves the part the maker built, and an authorized-reseller badge proves who the seller was when the badge was granted; neither tells you who owns the shop today, so trust in a sales channel should lapse on a change of owner the way a bank's does, until someone has looked at the new one. ## Sources Bitcoin.com News, "Ledger confirms hidden hardware implant in affected user's wallet", 10 October 2026\. [https://news.bitcoin.com/security/ledger-confirms-hidden-hardware-implant-in-affected-users-wallet/](https://news.bitcoin.com/security/ledger-confirms-hidden-hardware-implant-in-affected-users-wallet/?ref=dailyferment.com) Help Net Security, "Hidden implant in Ledger hardware wallets linked to $93M theft", 12 October 2026\. [https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/](https://www.helpnetsecurity.com/2026/10/12/ledger-wallets-compromised-via-hardware-implant/?ref=dailyferment.com) The Crypto Times, "Tampered Ledgers reported in Europe as CZ says hackers bought the reseller", 12 October 2026\. [https://www.cryptotimes.io/2026/10/12/tampered-ledgers-reported-in-europe-as-cz-says-hackers-bought-the-reseller/](https://www.cryptotimes.io/2026/10/12/tampered-ledgers-reported-in-europe-as-cz-says-hackers-bought-the-reseller/?ref=dailyferment.com) The Hacker News, "Ledger finds unauthorized hardware implant in CryptoBilis-sold wallet amid fund theft reports", 12 October 2026\. [https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html](https://thehackernews.com/2026/10/ledger-finds-unauthorized-hardware.html?ref=dailyferment.com) KuCoin Flash, citing BlockBeats, "CryptoBilis ownership shifts to Chinese individual amid Ledger security probe", 10 October 2026\. [https://www.kucoin.com/news/flash/cryptobilis-ownership-shifts-to-chinese-individual-amid-ledger-security-probe](https://www.kucoin.com/news/flash/cryptobilis-ownership-shifts-to-chinese-individual-amid-ledger-security-probe?ref=dailyferment.com) Morten Christensen, AirdropAlert, "CryptoBilis sold before the Ledger drain: owner, NDA, timeline", 10 October 2026\. [https://airdropalert.com/blogs/cryptobilis-sold/](https://airdropalert.com/blogs/cryptobilis-sold/?ref=dailyferment.com) FDIC, RMS Applications Procedures Manual, section 5, Change in Bank Control. [https://www.fdic.gov/regulations/applications/resources/apps-proc-manual/section-05-changeincontrol.pdf](https://www.fdic.gov/regulations/applications/resources/apps-proc-manual/section-05-changeincontrol.pdf?ref=dailyferment.com)