Solana Security: Is Your Hardware Wallet Safe? Buy & Re-seed

Bought from CryptoBilis? Do this today

As of 10 October 2026. Ledger is investigating lost funds from users in Southeast Asia who bought devices from CryptoBilis, an authorised reseller (a shop the maker officially lists) in Malaysia, the Philippines and Indonesia. Ledger has confirmed that one affected user’s device had an unauthorised hardware implant, and it has asked CryptoBilis to pause sales and shipments.

Ledger’s advice if you bought from CryptoBilis in the last 90 days:

1. Not set up yet: don’t set it up.
2. Already set up: consider moving your assets to a new Ledger device with a new seed.

CryptoBilis also sells through its own Shopee and Lazada stores, so a device bought there counts the same.

I wouldn’t treat that “consider” as optional. Headlines call it the Ledger CryptoBilis hack, but Ledger says there’s no confirmed evidence its own systems were compromised. The leading explanation is a supply chain attack: the devices were tampered with before they reached buyers, so the attacker could get the recovery phrase. Researchers estimate tens of millions of dollars were taken. Ledger hasn’t confirmed a total.

Most of it was BTC, ETH and Tron, but some Solana wallets were drained too. Staking doesn’t protect SOL on an exposed seed. Whoever holds the seed can unstake it and take it.

CryptoBilis also sold Trezor, OneKey, SafePal and other brands, and none of those makers had commented by 9 October. Treat any device from there the same way, and if there’s real money on it, move it today.

Anyone who DMs you offering to “recover” your funds is running a scam. Ledger will never ask for your recovery phrase.

Is my Ledger or hardware wallet safe? Four questions

1. Where did you buy it? The maker’s shop, its official Amazon storefront or a seller on the maker’s list other than CryptoBilis: you’re fine. CryptoBilis: follow the section above. A random marketplace seller, Facebook, eBay, second-hand or “discounted” stock: move your funds.
2. Did anything come already set? A genuine Ledger never arrives with a recovery phrase or PIN already set. A filled-in recovery sheet, a scratch card or a chosen PIN means you move your funds.
3. Did the device create your words? If it showed you the words during setup, you’re fine. If you restored from words that came in the box or that someone gave you, move your funds.
4. Does your history show anything you didn’t sign? Paste your address into Solscan and scroll back. Our guide to reading a block explorer explains each line. Small test transfers out, stake changes or approvals you don’t recognise are bad signs. Tiny incoming transfers from lookalike addresses are address poisoning, not a sign your seed is exposed.

How to move your Solana to a fresh seed

A new seed means a brand-new wallet with new addresses. Nothing moves by itself: you send every asset across. Everything except native stake fits in one sitting.

1. Make the new wallet

On a device bought direct, check the box and run Genuine Check first (see below). Then set it up as new and write down the words it shows you. Our wallet setup guide covers backing up the new seed. Never restore the old phrase onto it.

New device still in the post? Don’t leave funds on the old seed for days. Create (never import) a brand-new wallet in Solflare, Jupiter or Backpack on a phone or computer you trust. Move everything there today, then move it again when the device arrives. Don’t reuse a CryptoBilis device after a reset, because a reset doesn’t remove a physical implant.

For the app, I think Solflare is way better than Phantom now. Phantom’s fallen off massively and feels slower to me. Jupiter’s wallet is obviously great and Backpack is good too. Check your device works with the app first. Phantom doesn’t support the Ledger Nano Gen5 or any Trezor, so a Trezor goes into Backpack or Jupiter’s browser extension. When you add the hardware account, check that the receive address on the device’s screen matches the app.

2. Send a small test

Send a little SOL and check it lands. Every token you send to a fresh wallet needs a token account there, and the sender pays a refundable deposit of about 0.0015 SOL to open each one. Keep that much per token on the old wallet, plus a little spare, until the end.

3. Staked SOL next, because it has a clock

Native stake sits in a stake account your old seed controls, so anyone else with that seed can unstake and withdraw it too. Two ways out:

• Unstake now. The stake unlocks at the end of the current epoch (Solana’s staking period, about a day since the 9 October upgrade). Then withdraw the SOL and send it. Move your tokens while you wait. Here’s unstaking step by step.
• Convert it to an LST, a liquid staking token like JupSOL that stands for staked SOL. On Sanctum, the Migrate page turns active stake into an LST without the unstaking wait, and the LST then moves like any token. It only takes active stake, so anything you delegated this epoch has to unstake. For a big stake, this is the route I’d take.

4. Stablecoins and tokens

Send USDC, USDT and your other tokens. LSTs you already hold move instantly (how LSTs work). Skip dust and dead memecoins. They aren’t worth the deposit.

5. LP positions, lending and open orders

Anything you’ve put into Solana DeFi apps belongs to the address that opened it. Close your positions on Meteora and other pools, withdraw lending deposits and cancel Jupiter limit orders and DCAs. As an LP, this is the bit I’d hate most. Closing mid-range means taking whatever the position is worth right now. Still, a bad close beats leaving it on a seed someone else might have.

6. NFTs and .sol domains

Send your NFTs and transfer any .sol domain to the new address.

7. The last of the SOL

If your wallet lets you close empty token accounts, close the ones on the old wallet to get the deposits back. Then send the remaining SOL with the max button and stop using the old seed for good. Don’t import it into a hot wallet “just to check”.

Airdrop points and wallet history stay with the old address. Annoying if you farm, but no reason to leave money on an exposed seed.

Where to buy a hardware wallet safely

I’d buy direct from the maker. If you can’t, here’s the order, safest first:

1. The maker’s own shop: Ledger’s or Solflare’s (both linked at the top), or Trezor’s.
2. The maker’s official Amazon storefront or a listed reseller. Check Ledger’s list (also linked at the top) or Trezor’s where-to-buy page. On Amazon, compare the “Sold by” name with that list. CryptoBilis was on Ledger’s list too, so a listed reseller is still a step down from buying direct.
3. Never: random marketplace sellers, Facebook, eBay, second-hand, open-box, or anything priced below the maker’s own shop.

A Solflare Shield is the cheapest cold storage we cover for Solana, and the Origin is $49 right now. You sign by tapping the card on your phone in the Solflare app. A Ledger works with more wallets and more chains.

When the box arrives: check before you set it up

Stop and contact the maker through its own website if you see any of these:

• a recovery sheet with words already filled in
• a scratch card with words under it
• a leaflet saying a PIN is already set
• a device that doesn’t offer to set up as new
• seals that are cut, opened or re-glued

A clean box proves less than you’d think. The implant Ledger found was inside the device.

Safe setup for a Ledger:

1. Type ledger.com/start into the address bar yourself. Fake “ledger.com/start” pages show up in Google results.
2. Install Ledger Wallet. It’s the new name for Ledger Live, and Ledger now calls its devices “signers”.
3. Set up as a new device, pick a PIN and write the 24 words it shows you on the blank card. Never type them into any app, website or phone.
4. Run Genuine Check, Ledger’s in-app authenticity check. Open My Ledger, approve the prompt on the device, and the app confirms the device is genuine. If it fails, don’t send any funds to it, and contact Ledger Support through ledger.com.

Genuine Check proves the secure chip is a real Ledger chip. Ledger itself says it can’t detect implants added while the original chip stays intact, and an implant is what Ledger found in this case. That’s why where you buy matters more than anything you can spot at home.

A Shield is similar. The card creates a new 12-word phrase during setup in the Solflare app and shows it once, and you write it on paper. It should never arrive with words.

Everyday Solana security habits

• Run two wallets. Keep the bulk on the hardware wallet and use a small hot wallet for trading, airdrops and new apps.
• Keep the seed offline, on paper or metal, in two places. Never as a photo or in a cloud drive, notes app or password manager. Once, with a small balance, check that you can restore from what you wrote down.
• Read before you sign. Solflare previews each transaction and shows what leaves your wallet. If SOL or tokens are going out that you didn’t expect, reject it. On a hardware wallet, read the device screen too.
• Fake claim pages, fake support accounts and anything asking for your seed are the usual way Solana wallets get emptied. Learn the common airdrop scams, and open apps from your own bookmarks.
• Watch for address poisoning. Scammers send tiny amounts from addresses that start and end like ones you use. Copy addresses from the source and check the middle characters.
• Revoke token delegations you don’t use. Your wallet’s settings list the apps allowed to spend your tokens, and disconnecting a site leaves that permission in place.
• Use an authenticator app for 2FA on exchanges and email. SMS codes can be stolen with a SIM swap, so ask your carrier for a port-out PIN too.

More wallet basics sit in our Solana beginners’ hub.

Holding a lot of SOL? Use a multisig and split brands

• Squads lets you set up a vault where, say, two of three keys must approve each transfer. Use signers from two different hardware brands, each bought direct, so one bad batch can’t sign on its own.
• Only add a passphrase if you’ll remember it. It’s an extra word on top of your seed that opens a separate hidden wallet. Lose it and those funds are gone.
• Leave your family written instructions: where the devices and backups are and how the setup works. Keep the seed itself out of that note.

FAQ

Is CryptoBilis legit?

Yes, it was a genuine Ledger-authorised reseller, which is why this caught people out. Ledger has asked it to pause sales while it investigates, and I wouldn’t buy a hardware wallet from it until Ledger publishes its findings.

Is my crypto safe on a Ledger?

Yes, if you bought it direct or from a listed reseller other than CryptoBilis, it arrived blank and the device created your words. Ledger says the problem was tampered devices from one reseller, not its own systems.

Where can I buy a genuine Ledger in Malaysia, Indonesia or the Philippines?

In Malaysia or Indonesia, try Ledger’s own shop first: if your country is offered at checkout, that’s the safest route. Ledger has said it can’t ship to the Philippines because of local regulations. There, buy only from a seller on Ledger’s official reseller list, opened from the list itself rather than a search result, and skip marketplace listings, the channel CryptoBilis sold through.