Hackers Allegedly Bought Their Way Into Your Hardware Wallet Supply Chain

Binance founder CZ is alleging that the threat actors behind recent Ledger wallet drains didn't just hack a system — they bought a company to do it.

The target: CryptoBilis, an authorized Ledger reseller. CZ's public allegation is that bad actors acquired CryptoBilis specifically to gain access to the infrastructure needed to compromise wallets at scale. If true, this isn't a smash-and-grab exploit. This is a long-game supply chain attack, and it may have been sitting inside the Ledger ecosystem for months.

The Timeline Everyone Should Be Reading Carefully

Here's where it gets worse. CryptoBilis's former founders say they handed over operations back in March. March. That means whoever took control of this reseller had roughly seven months of runway before any public disclosure was required.

Why the delay? The acquisition agreement, according to the former founders, contractually prevented a public announcement until mid-October. Seven months of silence baked into a legal document. Whether that clause was standard practice or something more deliberate is now a question Ledger and investigators will have to answer.

Ledger confirmed it is actively probing the wallet drain incidents. The company has not yet publicly confirmed or denied CZ's specific allegations about the nature of the acquisition.

Why This Is Different From a Standard Hack

Most crypto exploits follow a familiar pattern: find a vulnerability, drain funds, disappear. This alleged attack vector is far more sophisticated. Acquiring a legitimate reseller gives bad actors cover, credibility, and physical or digital access to hardware before it ever reaches an end user.

This is the supply chain attack scenario that security researchers have warned about for years. If devices are being compromised before they ship, no amount of careful wallet hygiene by the user protects them. The threat is upstream.

CZ flagging this publicly matters. His reach moves markets and shapes community response faster than most official disclosures. The fact that he is amplifying this story signals that the crypto security community should treat this as a five-alarm situation, not routine noise.

What Hardware Wallet Holders Should Do Right Now

Do not dismiss this as someone else's problem. If you own a Ledger device purchased through any third-party reseller, verify your device's authenticity using Ledger's official onboarding process, which is designed to detect tampering. Buy directly from Ledger's official website if you are purchasing new hardware.

Watch Ledger's official channels closely over the next 48 to 72 hours for a formal response. If confirmed, expect this story to accelerate regulatory scrutiny around hardware wallet resellers across every major jurisdiction.

The attack surface for crypto just expanded. Act like it.