Ledger did not remove CryptoBilis: it relabeled it as paused

Ledger does indeed delete resellers from its official list: between October 12 and 13, 2026, one disappeared—Geekay, in the UAE—and the list went from 153 entries to 152. CryptoBilis, the Southeast Asian store it asked to stop sales on Oct-9 following thefts from its buyers, has not been deleted: it remains published with its logo, live link, and active online sales indicator, with a notice typed into the name field: Cryptobilis- Sales temporarily paused. In that same interval, the pause notation increased from 2 entries to 5 and from two countries to three: the Shopee store in Malaysia and the Lazada and Shopee stores in the Philippines were added, leaving Malaysia without a single active reseller. What failed in this case was not the device or the code: it was the ownership of the channel, which changed hands in March 2026 according to the store's former co-founder, without the authorized reseller tag moving for seven months. This article separates what Ledger has said from what third parties have claimed, measures the two-day series on the official list, breaks down which mitigations survive a channel acquisition, and corrects three of our own articles that currently recommend buying from an authorized distributor as a remedy.

What happened to CryptoBilis, the authorized Ledger reseller in Southeast Asia?

CryptoBilis is a hardware wallet store founded around 2020 in Malaysia, according to ABAB News, which presents itself on its own website as a brand of the company CB International and, in its commercial material collected by Protos, as "the authorized reseller of Ledger products in Malaysia." It sold Ledger, Trezor, OneKey, Tangem, and SafePal, among other brands. BitPinas and ABAB News place its coverage in three markets: Malaysia, the Philippines, and Indonesia.

On Oct-9-2026, Ledger said it was investigating fund losses from users in Southeast Asia who had purchased through that channel and asked CryptoBilis to stop all sales and shipments of Ledger devices. On Oct-10, it confirmed that a device from an affected user contained an unauthorized hardware implant, and on Oct-11, it published a 72-hour update. Everything else written about the case—the amount stolen, what the implant is made of, how many devices carry it, the change of ownership—comes from various third parties, and most reports have blended these with Ledger's voice into a single narrative.

The detail that makes this case different from those we have already covered: there is no compromised code. The device that arrived at each buyer's home passed all the checks the buyer could perform: the box, the seal, and the origin. It arrived through the legitimate channel, the one listed on the manufacturer's website. That it contained an implant was confirmed by Ledger on Oct-10; what it is made of is described by Karpelès.

What has Ledger said in its own voice and what have third parties said?

The following is Ledger only, with the date and the media outlet that reported it.

Ledger has not provided any figures: neither the amount stolen nor the number of victims. All the money circulating in headlines comes from third parties, and it is worth knowing who they are.

The boundary is not where most reports place it. Ledger confirmed the implant: it did so on Oct-10 at 17:09 UTC in a single sentence, "one of the impacted users’ devices contained an unauthorized hardware implant." One device, from one affected user. What Ledger has not said at any point is what that implant is made of—the microcontroller, LTE module, eSIM, and internal bus are Karpelès' description, with his photos from Oct-9—how many units carry it, or that it was the implant that emptied the wallets. These are three distinct things traveling together in headlines as if the manufacturer had confirmed them.

Its only quantifiable statement remains "the volume of impacted devices is limited," from Oct-11 at 17:13 UTC, and it still lacks a number. Measured in devices, it can coexist with the five third-party amounts, which range from 72 to 93.4 million dollars and are measured in money and addresses. But it only coexists if "limited" allows for hundreds of devices, and that requires assuming one wallet per device, which is our own assumption. Ledger has not given the number, so it remains unresolved today.

Is Ledger still listing CryptoBilis, and what changed in the list between October 12 and 13, 2026?

Yes, it is still listed. This is our reading of the official Ledger reseller page, taken twice with 27 hours and 39 minutes of separation. The second reading says more than the first, because the page moved between the two.

The Geekay row forces a refinement of the argument, and in an uncomfortable direction. A list that only knew how to add notations would be a tool limitation. But Ledger removes entries: it deleted one in the same interval it noted three. There is no public reason for Geekay's disappearance, nor is one attributed here: it could be the ordinary end of a commercial agreement, a change of operator, or anything else. What is verifiable is what the two readings show together: one entry left the list while the entry for the channel whose buyers have lost funds remained, with its logo and link live. Keeping CryptoBilis published is a choice, not a technical restriction.

The five paused entries from Oct-13 retain the same three elements: logo, link to their domain, and active online store indicator, just like any reseller in good standing in the other 42 countries. No field in the entry records status, ownership, or verification date. And the notation reveals how it is made internally, because it appears with three different spellings and one typo: Cryptobilis- Sales temporarily paused with no space before the hyphen; Shopee Mall - Ledger Authorized Reseller Store - Sales temporarily paused with a spaced hyphen; and in the Philippine Shopee entry, -Sales temporarily paused with no space after the hyphen and an extra space at the end. The same notice written three ways on the same page does not come from any status field: it is typed by hand into the store name, which is the only place it fits. The structure of the list confirms this: each entry has a name, link, logo, and two indicators for online or physical store sales, and nothing else. There is no field for status, ownership, or verification date.

The same page contains another piece of hand-written prose, serving as a contrast: a disclaimer warning the buyer that "Ledger is not a party to this transaction," that the purchase, payment, and delivery are the reseller's and fall under their own terms. It appears only once on the entire page, in the redirection notice for a specific reseller in Turkey, and is not in the CryptoBilis entry or any other. It is not the general policy of the list: it is a specific notice someone wrote once for one case.

The movement also resolves the caution carried over from the first reading. CryptoBilis never appears on the Philippine list, neither on October 12 nor 13, even though BitPinas and ABAB News placed the reseller in three markets. What does appear in the Philippines on Oct-13 are its two paused marketplace stores—Lazada and Shopee—and a third active reseller, CryptoKing. In Malaysia, its only two entries are paused, so the country is left without an operational authorized reseller. In Indonesia, however, the other three entries (N-Crypt, Tokopedia, and the local Shopee store) remain without notation, even though the Shopee stores in Malaysia and the Philippines have it.

And that directly impacts the most verifiable claim Ledger made. On Oct-9, it said the incident was isolated to that reseller and that market. As of Oct-13, the pause notation covers five entries in three countries. There are two possible interpretations and none is chosen here: either the contamination is wider than the statement claimed, or those Shopee and Lazada stores were CryptoBilis's channels within the marketplaces, which would fit with the press placing the reseller in Indonesia, Malaysia, and the Philippines from day one. No public source clarifies this, and the difference between the two matters greatly to anyone who bought a Ledger in one of those three stores.

Does the CryptoBilis pause affect only Ledger products?

The expectation was yes: Ledger asks to stop its sales, the channel removes Ledger products and continues selling other brands. If so, the pause would be a manufacturer's measure over its own inventory, silent on the store's status. That is not what we find.

In the store, the Ledger product listing returns 12 references—11 from Ledger, from the Nano Gen5 to the Nano S Plus, plus an Ellipal—and all 12 are out of stock in both readings, Oct-12 and Oct-13. In the general listing, another 12 references appear from Arculus, CoolWallet, D'CENT, BitMiner, BitSafe, and Cryptosteel, and only one is available: an entry for Bitcoin Pizza Day 2025. The pause covers all brands, and Ledger says this too: on Oct-10, it stated that CryptoBilis "has ceased sales of all hardware wallet inventory until the investigation is concluded." This matches the notice the store itself published according to BitPinas, suspending sales and shipments of hardware wallets of all brands, online and in its physical stores.

Two cautions on this reading. The general listing page responds with a page not found title and is marked as non-indexable even though it renders 12 products, so those references are only a partial grid of the catalog: one cannot say "the entire catalog." And the store's homepage, read both days, continued to announce in its top banner that orders ship the next business day from Kuala Lumpur, without any visible notice of the incident.

What does "authorized reseller" mean if no one checks who the owner is?

The CryptoBilis entry has the same five fields on October 12 and 13, 2026, as any other on the page: name, link, logo, online sales indicator, and physical store indicator. None records who the owner is or when they were verified. Between March and October 2026, according to the former co-founder, the company changed ownership and none of those five fields moved.

This is what makes this case different from the security failures usually covered by the press. There is no control that someone bypassed: on the axis of channel ownership, there is no field to look at. The final buyer can only check what the page shows them, which is the store name and the link.

The next question is why no one re-verifies it, and the answer is written on the same page. A reseller list is a commercial tool: it serves to help a buyer in Jakarta or Kuala Lumpur find a place to pay in local currency and receive the package in days instead of weeks. Its function is to drive sales, and for that, a name and a link suffice. What the page does not do anywhere is vouch for who is behind the business: there is not a single field that states it or dates it. None of the entries show a verification date or owner. Deleting an entry is cheap, as the Geekay one proved. What does not exist is the signal that would say when it is time to delete it: a change of ownership of a company does not reach the list through any channel.

It is worth establishing the distinction with the other three axes we have already measured, as they are easily confused. In the 2026 attacks against npm packages and Connect Kit, the axis was the code: a poisoned dependency, a valid signature certifying malware, the device and channel intact. In the Coldcard firmware entropy flaw, the axis was the manufacturer: the product left the factory defective and the channel had nothing to do with it. In the ShipMonk breach that affected Trezor customers, the axis was a logistics provider, and what was leaked was customer data, not devices. Here, the axis is the ownership of the company delivering the box, and it is the only one of the four that leaves no technical trace anywhere. It is the same direction we pointed to in the count of attacks against infrastructure instead of contracts, one step further out: from the contract to the server, from the server to the distributor's shareholding.

Who bought CryptoBilis and what will be known on October 19, 2026?

Here the quality of information drops significantly, and this must be stated before summarizing it.

The first two rows do not align with the third. If the sale closed in March and the registry shows 100% ownership since August 3, there are five months that no source reconciles: it could be the normal lag between contract and registration, it could be two stages of the same operation, or it could be a misreading of the registry. All three remain open.

Nor is any intent behind the confidentiality clause documented. What is measurable is its effect: between March and October 2026, the store continued operating with the authorized reseller brand intact while the public could not know who its owner was. That is what is documented; the intent with which the clause was signed is not.

And the line this piece does not cross: no one has proven that the new owner is behind the theft. There is no public forensic investigation linking them, and both BitPinas and ABAB News explicitly state this in their own reports. The nationality and residence of the new owner serve to date the change of ownership and nothing else.

Which mitigations work against a channel acquisition and which do not?

What Ledger asks, literally and dated Oct-9-2026: anyone who bought from CryptoBilis in the 90 days prior to the notice, from July 11 to October 9, 2026, must not initialize the device; those who have already initialized it must move funds to a new signer with a new seed. Beyond that, the breakdown of what survives this vector and what does not.

The calculation is ours: 90 days before Oct-9-2026 is Jul-11-2026. The window of Ledger's recommendation begins four months after the month in which, according to its former co-founder, the store changed owners. Anyone who bought in April, May, or June falls outside the notice as written. Ledger has not said the two dates are related, nor explained where the 90-day window comes from, which is why the practical reading is conservative: if the device came from that channel at any point in 2026, the 90-day period is not the relevant criterion.

There is an added risk in the reaction itself. Security researcher Taylor Monahan warned on Oct-9, as reported by Protos, that the alarm was making people think of a zero-day vulnerability that does not seem to exist, and that those moving funds quickly expose themselves to phishing that targets precisely that haste. The practical review of migration is in the guide to the safest way to hold crypto.

Does buying from an authorized Ledger reseller protect against a store ownership change?

Buying from an authorized distributor does not protect against a channel that changes owners. Three of our articles present it as if it did as of Oct-13-2026, and all three need correction.

• What is a hardware wallet presents ordering "directly from the manufacturer's website or from an authorized distributor" as two equivalent paths. They are not.
• Self-custody 101 guide offers "authorized distributors or directly from the manufacturer" as an indifferent choice. Reseller ownership undoes this.
• The safest way to hold crypto treats channel risk as exclusive to third-party sellers on large online marketplaces. CryptoBilis was on the official list.

The correction that needs to be written in all three is the same. Authorization reduces the risk of counterfeit products, which is a real and frequent risk, but leaves ownership risk intact. The two paths are not interchangeable: buying from the manufacturer eliminates a link, buying from an authorized reseller maintains it with a tag that was granted once.

What will change in the Ledger reseller list on October 19 and November 12, 2026?

Three things, with dates.

Meanwhile, what a buyer can evaluate since Oct-9-2026 is concrete: the official reseller list of a hardware wallet manufacturer is a commercial directory, not a current certificate. It says a store was approved at some point, and the series from October 12 to 13 shows that the manufacturer deleted one entry between October 12 and 13, 2026. What the list does not say—and, in Ledger's case, has no place to say—is who currently owns the store it is sending you to.

Sources and links: Official Ledger Reseller List · Protos, Oct-9-2026 · Crypto Briefing · BitPinas · ABAB News, Oct-10-2026 · Benzinga · Bitcoin Magazine · Bitcoin.com News, Oct-10-2026 · crypto.news, Oct-10-2026 · CryptoBilis (store homepage, read Oct-12 and Oct-13-2026)