Ledger Warns Customers About CryptoBilis Hardware Wallets
Ledger is investigating reports that hardware wallets sold by Southeast Asian reseller CryptoBilis may have been physically altered. In a support post, Ledger said it had asked CryptoBilis to pause sales and shipments while the reports are examined.
The warning followed a community report involving a Ledger Nano X allegedly purchased in Malaysia. Images shared online purportedly showed a concealed antenna and SIM-related component inside the device. These claims have not, based on the supplied information, been independently established as the cause of the reported losses.
Customers who recently purchased a device through CryptoBilis have been advised not to initialize it until they receive appropriate guidance. Those who have already used a potentially affected device should assess their exposure and consider moving assets to a new, trusted signing device with a newly generated recovery phrase. The advisory concerns CryptoBilis-sourced devices; it is not a blanket warning that all Ledger hardware wallets are compromised.
Reported Crypto Losses Exceed $86 Million
Onchain investigators cited in the reports estimate that losses exceed $86 million across hundreds of wallets and multiple blockchain networks. The figure remains an estimate associated with the ongoing claims, rather than a final, independently verified accounting of losses linked to the alleged device tampering.
The incident has also raised questions about CryptoBilis’ ownership and management. Former co-founders Arravind Prabu and Vimalatheethan reportedly said they completed an operational handover in March 2026 and no longer have access to the company’s systems or management. A separate post claimed that the company was acquired by a Chinese national earlier this year.
Security researcher Taylor Vano has commented on the case, while other online investigators have attempted to attribute related onchain activity. Such attribution should be treated cautiously until supported by independently verified evidence. Customers should rely on official security guidance and avoid entering recovery phrases into websites, forms or messages claiming to help recover funds.
Credifi Introduces zkTLS Credit Verification for USDC Loans
In a separate development, lending protocol Credifi has launched an iOS app and Chrome extension that use zero-knowledge Transport Layer Security, or zkTLS, to verify credit-score information from Experian, NerdWallet and Credit Karma. The launch was announced in a post from Credifi.
The technology is intended to let a user demonstrate that information retrieved from an online service is authentic and has not been altered, while reducing the need to expose the underlying information in full. Credifi says the checks can help it screen applicants before requesting more expensive credit reports and bank-statement verification for borrowers who qualify for further underwriting.
Credifi estimates that underwriting and verification cost between $50 and $80 per funded loan. For a three-month loan, the company says these costs can add approximately three to 19 percentage points to the annual percentage rate (APR). These figures are Credifi’s estimates and may depend on loan size, underwriting requirements and other conditions.
How zkTLS Fits Into Credifi’s Lending Model
Credifi focuses on uncollateralized USDC loans, meaning borrowers do not necessarily need to deposit crypto assets as collateral. Credit verification is intended to give the protocol another way to evaluate applicants, but it does not guarantee loan approval or eliminate the need for additional checks.
The new credit-screening tools should also be distinguished from Credifi’s previously announced USDC microloans on Base. That offering was described as available to borrowers with an Ethos score of at least 1,800, with loans of up to $3,000 and no know-your-customer (KYC) requirement, according to the supplied report. The new zkTLS launch does not, by itself, establish that all of those conditions apply to every Credifi product.
The approach illustrates one potential use of privacy-oriented verification: proving that a piece of financial information meets a requirement without repeatedly sharing the full record. Its practical value will depend on the reliability of the verification process, the information providers supported and how Credifi uses the results in lending decisions.
New York Permanently Bars Former Celsius CEO Alex Mashinsky
New York Attorney General Letitia James announced on October 9, 2026, that her office had secured up to $35 million in conditional payments from Alex Mashinsky, the former CEO and co-founder of Celsius Network. The settlement also permanently bars Mashinsky from participating in the securities, commodities and cryptocurrency industries, according to the New York Attorney General’s official announcement.
The state’s lawsuit alleged that Mashinsky misled hundreds of thousands of investors about Celsius’ safety and investment risks, encouraging them to deposit billions of dollars in digital assets. The attorney general said Celsius made risky investments and concealed losses. Mashinsky is separately serving a 12-year federal prison sentence following a federal criminal case.
The state’s settlement includes conditional payments tied to the federal case. New York can receive $25 million if Mashinsky fails to forfeit $10 million in ill-gotten gains to the federal government, in addition to assets already forfeited. A further $10 million is payable to the state if he does not serve his full prison sentence. These are conditional obligations, so the maximum $35 million should not be described as an unconditional payment already received by New York.
Three Developments Highlight Different Crypto Risks
The three stories concern different parts of the digital-asset ecosystem. The CryptoBilis investigation highlights the importance of hardware supply-chain security and verifying the source of devices used to protect private keys. Credifi’s launch focuses on using cryptographic verification to support credit screening for digital-asset lending. The Mashinsky settlement underscores the legal consequences that can follow alleged misconduct in crypto financial services.
For users, the immediate priorities differ. Anyone who bought a potentially affected CryptoBilis device should follow Ledger’s official guidance before using it. Borrowers considering Credifi should review the product’s eligibility rules, costs and privacy disclosures. The Mashinsky settlement is a reminder to examine how crypto platforms describe risk, custody and the use of customer assets.
The cases also demonstrate why claims, estimates and confirmed legal outcomes should be reported separately. The wallet investigation remains subject to verification, Credifi’s cost figures are company estimates, and the maximum payment under the New York settlement depends on specified conditions.
