Recently, Ledger became embroiled in an asset-loss controversy. Some users in Southeast Asia reported that after purchasing hardware wallets from the reseller CryptoBilis, the assets in their wallets were transferred away. On October 9, Ledger announced that it had launched an investigation, asked the reseller to suspend sales and shipments, and reminded recent purchasers to hold off on setting up their devices, while users who had already set up their devices should consider migrating their assets.
On October 10, Ledger further stated that an unauthorized hardware implant had been found in the device of one affected user. The company said at the time that it had confirmed that the cases were related to devices sold by the reseller, and that it had not yet found any indication that its security infrastructure, systems or services had been compromised.
According to Bitquery's statistics, the relevant asset outflows involved 315 wallets and approximately USD 93.2 million. This is a third-party statistic, and Ledger has not yet confirmed the final scale of the losses. As of October 12, it remained under investigation at which stage the devices were modified and whether the implant was related to all of the losses.
Many people choose hardware wallets precisely because they hope to keep their assets more securely. Now that user-reported losses and anomalies on the devices have appeared at the same time, concern is inevitable. Determining the cause of the attack requires professional testing, and as for whether this finding can explain all of the losses, there is not yet a complete conclusion. For other wallet teams, this incident has already raised a question worth discussing: when users trust a wallet, which parts of the process are they actually trusting?
Image source: The Block, report dated October 9, 2026. The amount shown in the screenshot is an early estimate, and the scale of the losses is still being verified.
What makes this incident unsettling is that CryptoBilis had previously been on Ledger's official list of authorized resellers. Users who check the list on the official website and buy through authorized channels are already making a serious effort to avoid risk. Now, this purchasing path has also come within the scope of the investigation. For other hardware wallet and non-custodial wallet apps, what is worth discussing is: when users place their trust in a brand, are the commitments the manufacturer makes and the responsibilities it assumes stated clearly enough?
01 | The trust created by "official authorization" is something brands need to take seriously
It is very difficult for ordinary users to know what a device has gone through after it leaves the factory. When they choose an authorized reseller, they generally believe that the brand has already vetted the channel. Therefore, when a problem arises with a reseller, users naturally also turn to the brand for explanations and assistance.
For example, a user who is worried about buying a counterfeit product specifically checks the reseller list on the brand's official website and then places an order with a store on that list. The reason this store gained his trust lies both in factors relating to the store itself and in the brand's recommendation. If the device later has a problem, it would be hard for him to accept the brand and the seller telling him to "go to the other party." This is an understandable user reaction; legal liability still requires further investigation.
Brands and resellers are often two different business entities, and users generally cannot see the contracts between them or the division of after-sales responsibilities. If it is stated vaguely to the outside world what the authorization covers, which stages the brand participates in, and what assistance is provided after an anomaly occurs, a gap can easily emerge between users' expectations and the actual arrangements between the parties.
Users may not care how the brand and the reseller manage their relationship or cooperate, but these arrangements affect how matters are handled after an incident. It is best to have clear agreements at the time of cooperation on how much management authority the brand has over the channel, who reports anomalies, who contacts users, and who is responsible for after-sales service.
From a contractual perspective, the value of such arrangements lies in reducing disputes after an incident. Whether the reseller can provide purchase records, whether the brand can contact the relevant users directly, and how the parties cooperate in an investigation will all affect how matters move forward. The specific channel management approach to adopt requires the judgment of the business and security teams; at a minimum, both parties should know what they have agreed to and what they must cooperate on if a problem arises.
Whether and to what extent the brand bears liability depends on what went wrong with the device, what commitments the parties made, and the connection between the relevant conduct and the loss. However, since "official authorization" played a part in users' purchasing decisions, the brand needs to take seriously the trust that this generates.
For other hardware wallet manufacturers, authorization relationships are worth re-examining. When an official website recommends a particular channel, how will users understand that recommendation? If circumstances change during the cooperation, can the original arrangement still serve its purpose? These questions concern how a brand uses the words "official authorization," and also whom users may assert rights against after suffering a loss.
02 | Security capabilities should define the limits of commitments
Donjon, Ledger's security research team, states in public materials that Genuine Check primarily verifies the authenticity of the secure chip. Where the original secure chip remains intact, certain additional hardware modifications may go undetected. This check also cannot verify the complete sales and delivery history of a device.
For users, "verification passed" is easily understood as "the device is secure and safe to use." If the scope actually checked by the product is narrower, it is necessary to explain this distinction clearly. Whether security notices are understandable to ordinary users is also part of the product commitment.
The difficulty here is that technical teams and ordinary users may understand the same statement differently. Technical personnel know which component a given check verifies, while what users see may be merely a green mark. The check itself has completed its assigned task, yet users may still overestimate the protection it provides. Product descriptions need to account for this difference in understanding.
If a purchase page repeatedly emphasizes security while key limitations appear only in documentation that users can hardly find, two accounts may emerge in a dispute: the manufacturer believes it has explained matters, while users believe they were never reminded at the time of purchase and use. Whether this constitutes misleading conduct and whether the notices are adequate depend on the specific pages and the applicable law. However, explaining the limitations more clearly can indeed help reduce such disagreements.
Non-custodial wallet apps raise similar issues. "Open-source code," "audited," and "private keys held by users" each describe a particular feature of the product. Users may form broader security expectations on that basis. When advertising, manufacturers' accurately explaining the scope of these capabilities can help reduce misunderstandings and also reduce future liability disputes.
For example, an app may state that it has undergone a security audit. Users may understand this statement to mean that future use will be secure, whereas an audit typically has a corresponding subject matter, version and scope. Accurately disclosing this information does not diminish the capabilities the product already has. It gives users an opportunity to understand precisely which claims an audit report supports.
Wallet manufacturers are of course hard pressed to guarantee that all risks are eliminated. What concerns us more is whether external commitments match actual capabilities and whether important limitations are made known to users. The greater the gap among advertising, security descriptions and user agreements, the more likely it is that disputes will arise after an incident over "what exactly was promised at the time."
Image source: Ledger Donjon official website, screenshot taken on October 12, 2026. The page explains the limitations of Genuine Check in detecting additional hardware modifications.
03 | Private keys are held by users, but products and services still bear their respective responsibilities
Non-custodial wallets generally place the private key or signing authority in the user's hands. Users need to safeguard their recovery information and carefully verify transactions. However, users still rely on vendors to provide devices, software, and page information. If problems arise in these links, 'we do not hold private keys' does not answer the cause of the incident or the allocation of responsibility.
When using a non-custodial wallet, users may be responsible for signing themselves, but the transaction content they see, the exchange entry points they use, and the software updates they receive still come from the wallet and its partners. There are different participants here, and different work. The fact that assets are controlled by users does not make these service relationships disappear.
For example, a user uses a third-party exchange service within a wallet and later discovers that a transaction has gone wrong. The user needs to know who provides the service, at which step the wallet is involved, and at which link the problem occurred. The wallet may merely have displayed the entry point, or it may have participated in generating and displaying the transaction content; different circumstances will have different impacts on the assessment of responsibility. The brand marks on the page and the 'third-party services' in the contract both need to be examined in the context of the actual process.
From a lawyer's perspective, product commitments, risk disclosures, cooperation contracts, and user agreements are important materials for discussing these issues. They can help reconstruct what the parties agreed, but they must also be compared against the products and services actually delivered. A general 'non-custodial' label can hardly explain all the relationships.
Where a user leaks a mnemonic phrase, as compared with losses caused by device defects, software vulnerabilities, or misleading promotion, the assessment of responsibility will differ. User agreements may set out the responsibilities of the parties, but the effectiveness of exemption clauses still depends on the applicable law and the specific circumstances. As for the Ledger incident, it is still necessary to wait for the investigation to complete the facts before discussing compensation.
Communication after an incident also affects whether users can continue to trust the product. While the investigation is not yet complete, the vendor can explain the facts currently known, the issues being addressed, and where users can obtain help. Leaving necessary room for matters not yet determined is more prudent than hastily assuring that 'there is no problem.'
Suspending a certain channel, assisting the investigation, or providing replacement devices are all specific measures in incident handling. Liability for compensation still needs to be determined based on the investigation results and the parties' agreements. Whether assets can be successfully recovered also involves where the funds went and the authority of the relevant institutions. Users need to know what support is currently available and how their claims will be handled subsequently.
Mankun Lawyers' Summary
The technical cause of the Ledger incident remains to be ascertained by a professional team. As lawyers, we focus more on the relationship between user trust and the commitments of the parties: whether the authorizations on the official website, the security statements on the pages, and the liability arrangements in the agreements correspond to the products and services users actually receive.
Other wallet teams can re-examine their own business from this perspective. Users controlling assets themselves need to bear the corresponding safekeeping responsibilities; what vendors provide and what they promise are also worth explaining clearly. A relatively consistent understanding of these matters among the parties helps reduce misunderstandings in ordinary times and makes it easier to discuss what to do next when problems arise.
