Security alerts Distribution channel
Ledger: CryptoBilis distribution incident
Published 2026-10-15 Updated 2026-10-30
What Ledger confirmed
On 15 October 2026, Ledger said it had confirmed that some Ledger devices had been physically tampered with after leaving Ledger's control. Ledger described a localized distribution-channel attack involving devices sold through CryptoBilis. Its notice explains the affected channel and directs customers to its official response.
This is a report about devices in a particular distribution channel. It is not evidence that every device sold by Ledger, or every Ledger device, was affected. Check Ledger's notice for the latest instructions and product-specific details.
Read Ledger's official response.
Trezor's separate report
On 30 October 2026, Trezor said it had received a report concerning one Trezor Safe 5 purchased from CryptoBilis. Trezor had not yet examined that device when it published its notice, and described the report as credible. That is a reported case, not a confirmed finding of tampering by Trezor.
Trezor's notice said no loss had been reported to it at that time. It advised customers who bought a Trezor device from CryptoBilis from March 2026 onward to follow its guidance. Do not treat Ledger's confirmed findings as confirmation of the separate Trezor report.
Read Trezor's official notice.
Why the distinction matters
wallet.vip lists direct manufacturer store links separately from reseller channels. An authorized reseller is not the same thing as the brand's own store. Before acting on an alert, use the linked manufacturer's current notice and contact its official support channel if your purchase may be affected.
Published 15 October 2026 · Substantively updated 30 October 2026.