How did compromised hardware wallets reach Ledger customers?

Ledger says the confirmed cases in a reported wallet draining incident involve devices sold through CryptoBilis, a Southeast Asian reseller. An unauthorized hardware implant was found in one affected device. The investigation raises a question that wallet instructions rarely answer in full: what happens between a secure device leaving the manufacturer and a buyer seeing a recovery phrase on its screen? Ledger says confirmed October 2026 draining cases involve devices sold through reseller CryptoBilis. An unauthorized hardware implant was confirmed in 1 affected wallet, while the investigation remains open.