Authorised Isn’t Verified: The Reseller Layer as a Custody Risk

The Linkmerica Research Team · Research note · October 15, 2026

What happened

On October 9, 2026, Ledger opened an investigation into fund losses reported by customers who bought devices through CryptoBilis, an authorised reseller covering Malaysia, Indonesia and the Philippines, and asked it to pause Ledger sales and shipments. On October 10, Ledger confirmed that one affected user's device contained an unauthorised hardware implant. On October 11 it said all confirmed cases were tied to CryptoBilis and involved a limited number of devices, and told resellers never to restock returned products. On October 13 it asked resellers and distributors in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia and Hong Kong to suspend sales, stating that the only confirmed incidents remained in Southeast Asia and that it had no indication its own infrastructure, systems or services had been compromised. On-chain analysts have published loss estimates; Ledger has not confirmed a figure.

An authorised channel is a stated control

Every manufacturer Linkmerica rates tells buyers to purchase directly or from an authorised reseller. That instruction is a control: it narrows who handles a device before its owner does. But authorisation describes a commercial relationship. On its own, it does not describe what happens to a unit inside a reseller's premises.

Ledger's buying guidance, published about four weeks before the incident, draws the line itself. Its Genuine Check confirms authenticity "but cannot verify the device's physical supply chain history." The same page describes authorised resellers as commercially incentivised to source through Ledger or vetted distributors: encouraged, not required.

This is the pattern Linkmerica documented with customer data retention in The Purchase Record: a stated control, and the separate question of whether it was performed.

Why this layer sits outside most assessments

Custody assessments usually examine the device: the secure element, firmware signing, update integrity. The route from factory to buyer tends to be treated as a packaging question. But a check designed to authenticate a chip answers a different question from whether anything has been added beside it. A device can be genuine in every component a manufacturer can test and still not be in the condition it left the factory.

What we audited

To see how the eight manufacturers Linkmerica rates address this layer, we recorded what each publishes on five questions: whether it lists its authorised resellers; what its authenticity check is and what it says the check verifies; what tamper evidence it describes; whether it states a policy on returned, opened or used units; and whether it recommends direct purchase. We recorded only vendor-published material, with a source and access date for every field, and left unknowns blank.

Three findings stand out.

Reseller lists. Four of the eight publish, or state that they publish, a list of authorised resellers: Ledger, Trezor, Tangem and Coinkite. We could not find one for SafePal, ELLIPAL, Foundation or BitBox.

Returned and opened units. In the material we reviewed, no manufacturer published a rule for what resellers do with returned or opened units before this incident. Ledger issued one on October 11. Coinkite tells buyers not to rely on a used device, and SafePal's app flags devices that have been activated before; both are checks for the buyer, not rules for the reseller.

What the checks claim. Manufacturers describe their verification very differently. Ledger says its check cannot verify supply-chain history. Tangem says its first-tap check confirms a card "has not been tampered with." Foundation says its server-side check can "detect physical device tampering." Coinkite and Trezor emphasise physical provenance, such as numbered bags matched to an on-device serial and holographic seals, while ELLIPAL omits packaging seals in favour of a device designed to erase itself if opened. These are each manufacturer's own claims. Linkmerica has not tested them, and they describe different mechanisms rather than a ranking.

The audit informs Linkmerica's Supply Chain Risk category.

What remains unknown

Ledger has not said who installed the implant, at what point in the chain, or how many devices were affected. It has not published a root-cause analysis. Linkmerica's Ledger score stands and the wallet is under review, with an update due by November 13 or sooner if Ledger publishes its findings. For questions about a specific device, refer to the manufacturer's own support channels; Ledger's is support.ledger.com.

Disclosure

Linkmerica rates all eight manufacturers named here. It has no commercial relationship with any of them and accepts no payment from rated entities.

Sources

• Ledger investigation, implant confirmation, scope update and sales suspension: Ledger statements of October 9, 10, 11 and 13, 2026, as reported by CoinDesk, BleepingComputer, The Block and The Hacker News
• Ledger buying guidance: ledger.com/academy, "Best Practices To Securely Buy Your Ledger Signer," accessed 2026-10-15
• Reseller audit: each manufacturer's own website and support documentation, accessed 2026-10-15

Linkmerica is a trade name of CASPO LLC. Research is for informational purposes only and does not constitute financial or investment advice. Based on publicly available information as of October 15, 2026.