Karpelès said a user known as BenYorke noticed suspicious marks on the device and sent it to him for inspection rather than using it.
It remains unclear, though, whether the alleged tampering is connected to the CryptoBilis incidents.
The company said its wallets, app, and private keys were unaffected, but warned that the exposed information could be used for phishing attacks impersonating Tangem Support. Tangem said it was investigating the incident and working with its third-party service provider.
Ou said CoolBitX has received no reports of losses or suspected tampering involving CoolWallet devices bought through CryptoBilis and has no suspension or change in the reseller's status to announce.
He added that CoolWallet's hardware design raises barriers to physical tampering, while cautioning that no hardware wallet is immune to every supply-chain attack.
French crypto hardware wallet maker Ledger is telling customers who bought devices from CryptoBilis in the past 90 days not to set up unused wallets and to consider moving their funds if they already did.
But the Southeast Asian reseller at the center of the investigation had changed hands months before that warning window even began.
- Ledger said in an Oct. 9 post on X that it was investigating reports of lost funds from customers in Southeast Asia who bought devices from CryptoBilis, an authorized reseller operating across Malaysia, Indonesia and the Philippines,
- On-chain researchers have traced dozens of millions in suspected thefts across Bitcoin, Ethereum and TRON, though Ledger hasn't confirmed either estimate or established how many affected wallets were bought from CryptoBilis.
- Separately, corporate records and a former CryptoBilis co-founder indicate the reseller changed ownership earlier this year, before the purchases Ledger is now warning about.
CryptoBilis changed hands months before Ledger's warning window
CryptoBilis, a regional hardware crypto wallet distributor that sold Ledger and other devices across Southeast Asia, had already gone through an ownership change before the period Ledger is now scrutinizing.
- Arravind Prabu, a former CryptoBilis owner, wrote on X that the company had been acquired earlier this year and that the previous team had fully stepped away from operations, system access and management.
- In a separate post, he said the new management now controls CryptoBilis' accounts and that the former owners were contractually barred from publicly announcing the sale until Oct. 19.
Ledger still doesn't know how the funds were taken
Ledger hasn't explained how the reported losses occurred. Its warning tells customers who bought from CryptoBilis during the past 90 days not to initialize devices that haven't yet been set up.
Those already using one were told to consider moving their assets to a new Ledger signer with a newly generated recovery phrase.
One on-chain researcher, tanuki42, initially traced more than $72 million to addresses suspected of receiving stolen funds.
Former Mt. Gox chief executive Mark Karpelès, a crypto entrepreneur who has been examining several of the reported cases, asked users to photograph the circuit boards inside affected devices so he could look for signs of physical tampering.
Changpeng Zhao, the co-founder of Binance, separately said on X the information available so far appeared consistent with a localized supply-chain attack involving a single vendor and potentially fake or tampered devices.
For now, Ledger hasn't said whether the losses involved counterfeit devices, physical modifications, compromised recovery phrases or another attack method.
- CryptoBilis also advertised itself as an authorized reseller of several other hardware-wallet makers, including Trezor, Tangem, CoolWallet and OneKey.
- Tangem, a Swiss hardware-wallet company with Russian roots, said it was monitoring the Ledger incident and noted that its app checks whether a card has already been activated, which it said would help detect a pre-activated or pre-seeded device.
- Trezor, the Czech hardware-wallet maker, said it was also looking into the situation but had "no record of any such issue" involving its products.
- As of press time, OneKey made no public comments on the incident.
- In a comment to The Coinformer, CoolBitX CEO Michael Ou, the company behind CoolWallet, said CryptoBilis has been a CoolWallet reseller since 2021 and remains authorized, with its most recent order placed in March 2026.
- "We have no suspension or change in that status to announce at this time," Ou said.
- CoolBitX's support team found no reports of losses or suspected tampering involving CoolWallet devices bought through CryptoBilis, though Ou cautioned that the review wasn't a conclusive assessment of every device sold.
- He also said CoolWallet's cold-laminated card construction and secure element make physical modification more difficult, but added: "We do not claim that any hardware wallet is immune to all supply-chain attacks."