Ledger investigates $86M multi-chain wallet theft

TLDR

Ledger is investigating reports that hardware wallets sold via a Southeast Asian reseller were drained of funds, with third party loss estimates around $86 million but no confirmed root cause yet.

1. Reports link hundreds of drained wallets on Bitcoin, Ethereum and Tron to devices bought from reseller CryptoBilis, with on-chain analysts estimating losses above $86 million.
2. Ledger has frozen sales through that reseller and says any exploit, if confirmed, appears localized, with no evidence so far of a company-wide hardware or infrastructure breach.
3. Until more is known, the key risks are supply chain tampering and seed phrase compromise, so users should prioritize official purchase channels and closely follow Ledgers incident updates.

Deep Dive

1. What Has Actually Happened

Media and community reports describe a coordinated drain affecting Ledger hardware wallet users, primarily in Southeast Asia, whose devices were purchased through reseller CryptoBilis. On-chain investigator Specter traced inflows from hundreds of victim wallets across Bitcoin, Ethereum and Tron, estimating losses above $86 million and possibly closer to $87 million when adding chain-level data for ETH, BTC and USDT at the identified addresses. Several outlets, including Decrypt and Yahoo Finance, note that these figures come from blockchain analysis, not from Ledger itself, and the total number of victims and final loss amount remain unconfirmed.

2. How Ledger Is Responding And What Is Known

Ledger has publicly said it is investigating reports tied to wallets bought from CryptoBilis and asked that reseller to pause all sales and shipments while the probe continues. The company has advised customers who bought from CryptoBilis within the last 90 days not to initialize unused devices and suggested that those who already did may want to move funds to a new Ledger device with a freshly generated recovery phrase. In a separate statement to media, Ledger has said its own infrastructure and core services have not been compromised and that it currently sees the issue as isolated to the reseller channel and affected markets.

3. Likely Attack Vectors And Practical Risks

Commentary from investigators and industry figures highlights possible mechanisms such as tampered devices shipped with pre-known seed phrases, counterfeit units sold through an authorized reseller, or users being tricked into revealing recovery phrases off-device. None of these theories has been confirmed by Ledger. Binance co-founder Changpeng Zhao has suggested, based on available information, that this looks more like a localized supply chain issue than a universal Ledger vulnerability. Regardless of the final cause, the incident underscores that self-custody security depends not only on the hardware design but also on the integrity of the purchase channel and strict handling of recovery phrases.

Conclusion

The reported $86 million multi-chain theft tied to Ledger users appears, so far, to cluster around a single Southeast Asian reseller and a limited cohort of devices, with the loss tally coming from independent chain analysis rather than Ledgers own numbers. The investigation outcome will determine whether this is confirmed as a supply chain compromise, a pattern of seed phrase leaks, or something more systemic. Until then, hardware wallet users should treat this as a reminder that secure self-custody combines robust devices with careful sourcing and uncompromised recovery practices.