Three days after customers in Southeast Asia started reporting drained hardware wallets, Ledger posted a 72-hour update on X. Every confirmed case, the Paris firm said, involved devices sold through one reseller: CryptoBilis. On-chain researchers put suspected losses above $93 million. Ledger said its factories and direct channels were untouched. That sentence will not rebuild a cyber security program that treated the sealed box as a trust anchor. If your cybersecurity stack starts after the asset is on the network, you already inherited whatever left the shop.

Ledger Named the Shop After the Coins Moved

You bought a hardware wallet because keys on a laptop felt like a dare. Reasonable instinct. CryptoBilis still sat between the factory and the desk. Ledger’s October 11 update tried to draw a neat circle around geography and channel. Confirmed draining tied to the October 9 incident, the company said, involved devices sold through that reseller. Direct buyers, in the telling, could stop refreshing their balances.

Keep refreshing if you run a receiving dock. The implant story is a procurement failure wearing a consumer brand. Someone with physical access, after the unit left Ledger and before the buyer broke the seal, could hide hardware that waited for first use. The owner followed the ritual. Screen looked right. Seed got written down. Funds moved in. Then the coins left for an address the owner never meant to sign. Threat detection that waits for a login event has nothing to parse. There was no failed password spray. A brute-force campaign against a web form was surplus to requirements. The trusted object did the transfer.

This is a bad look for a company that sells the idea of an air gap in a plastic shell. Even a clean factory does not make the reseller a dummy pipe. A regional exclusive with a partner logo and a faster lead time is still a privileged handler of identity material. Your incident response, if treasury, IT, or an executive household used those devices, starts with serials and shipping paths, not with a press tab that says the plant in France is fine.

Enterprise readers already file YubiKeys, HSMs, out-of-band tokens, and jump-box hardware as secure by purchase. The packing list gets a checkmark. The board does not. You would never accept a domain-admin password from an unknown Slack user. You will accept a root of trust from a box that spent a week in a partner warehouse you have never audited.

Your Firewall and Your Plugins Arrive the Same Way

Same week, a different SKU, same class of mistake. SecurityWeek reported that CVE-2026-102255, a pre-authenticated SSRF flaw in SonicWall gear, was under exploit days after disclosure. SSRF does not need a stolen admin cookie. It needs an exposed service and a path to internal URLs the box can reach. Teams purchased that appliance as edge threat-protection. Then they left the management plane where scanners live. The vendor patch exists. Exploit traffic does not honor your CAB calendar.

WordPress shops got the marketplace edition. Patchstack told The Hacker News that CVE-2026-85097 in Bricksforge, scored 10.0, is being used for unauthenticated remote code execution. Attackers upload PHP and run it. No account. No plugin password. If a developer allow-listed a page builder because the demo looked clean, you imported a dropper with a settings screen. Defense in depth that stops at last month’s WAF signature will miss this week’s file in wp-content.

The $93 million theft and the CVSS 10.0 plugin both arrived through a channel you approved. The implant executed in silicon. The SonicWall flaw executes in firmware you exposed. Bricksforge executes in PHP you installed on purpose. SOC runbooks still open at malware on a workstation and password guessing against VPN. Staff those. Also staff the quiet failure: the asset was hostile, or reachable, the moment you accepted it.

Procurement Is a Cybersecurity Control You Rarely Staff

Stop litigating brand reputation in Slack. Staff intake. The work is vendor-neutral and it fits a real environment that already has change tickets and a loading dock.

This week, build a channel inventory, not a vendor list. For every hardware root of trust (tokens, HSMs, smart cards, treasury wallets, out-of-band authenticators) record who sold it, the serial, the date, and whether the OEM will attest that serial without going through the reseller. Units from gray market, regional exclusives, or we-can-ship-tomorrow partners go to a hold shelf. They do not touch production identity stores. Photograph seals. Ask the manufacturer, in a ticket you keep, whether that serial left in the expected firmware state.

Pull internet-facing management off firewall and VPN appliances. If a pre-auth SSRF can make unauthorized requests, the box should not reach your identity provider, the rest of the fleet, or RFC1918 apps. Patch CVE-class appliance bugs on an hours-to-days clock. Hunt device logs for odd outbound fetches initiated by the appliance itself. Ban scanner source ranges at the edge if you must, then go fix the listener; an ipban on yesterday’s exploit host is a delay, not security hardening.

Freeze unauthenticated plugin risk the same day. Inventory CMS extensions with a named human owner. Anything that accepts unauthenticated uploads is an incident until you prove the patched version is running and the file tree has no unexpected PHP. Restore from known-good if you cannot prove it. Popularity in a marketplace is a popularity metric.

Ongoing, receive high-assurance hardware onto an isolated bench. Provision throwaway secrets first. Never load production keys on first unbox. Rotate anything that sat in an unverified channel. Require signed updates for appliances and CMS components. Disable unused listeners. Write the unboxing-hostile playbook: who you call, which serials you burn, which accounts you assume already spent. Rehearse it when a vendor posts a 72-hour update that names a partner you also use. That is incident response for a device that never needed a foothold on your LAN.

Ledger can keep drawing a line around CryptoBilis. Your job is the serials, the management plane, and the plugin directory you already blessed. The next sealed box will look just as trustworthy as the last one.

Sources

• Hidden implant in Ledger hardware wallets linked to $93M theft
• Critical SonicWall Vulnerability Exploited Days After Disclosure
• Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE