Ledger probes $86M reseller wallet theft

TLDR

Ledger is investigating reports that roughly $72 million to $86 million in crypto was stolen from wallets tied to devices sold by Southeast Asian reseller CryptoBilis.

1. Onchain researchers trace suspected drains across Bitcoin, Ethereum and Tron, but the loss figure and attack method are still unconfirmed.
2. Ledger has halted sales via CryptoBilis and says its own infrastructure is not breached, pointing to a localized supply chain issue rather than a global Ledger failure.
3. Hardware wallet users face renewed focus on how and where they buy devices, with supply chain and seed handling now a critical security topic to watch.

Deep Dive

1. What Is Known So Far

Ledger is probing reports that customers in Indonesia, Malaysia and the Philippines who bought devices from authorized reseller CryptoBilis suffered large wallet drains, with researchers estimating suspected thefts from more than $72 million to over $86 million across multiple chains. Onchain analysts tanuki42 and Specter have linked inflows from hundreds of victim wallets on Bitcoin, Ethereum and Tron to clusters of addresses, including an estimate of about $86.9 million across 98 wallets, though this remains third party analysis and not confirmed by Ledger itself.

Ledger has asked CryptoBilis to suspend all sales and shipments and advised anyone who bought a device from that reseller in the past 90 days to treat it as potentially unsafe, while encouraging existing users to migrate funds to new wallets with freshly generated recovery phrases. The company has not yet disclosed how many customers are affected or confirmed the precise total losses.

Confidence: moderate because multiple credible reports agree on the basics, but the exact attack vector and victim count remain under investigation.

2. Localized Reseller Risk, Not A Global Ledger Breach

Ledger has stated that its production facilities, firmware, Ledger Live app and core infrastructure were not compromised, and that the incident appears isolated to devices sold through CryptoBilis and that region. Community commentary and early industry analysis point toward a possible supply chain attack, such as tampered devices or preprinted seed phrases inserted into reseller packaging, but this remains a hypothesis rather than a proven cause.

That distinction matters for the broader hardware wallet market. If the attack route is reseller tampering rather than a flaw in Ledgers cryptography or device design, the trust question shifts from are hardware wallets broken to how do buyers avoid compromised inventory and protect recovery phrases.

3. What To Watch Next And Key Security Themes

Several signals will matter in coming days and weeks: Ledgers formal incident report, any confirmation of a tampering mechanism at CryptoBilis, whether the tracked theft addresses move funds, and whether estimated losses climb beyond current $72 million to $86 million ranges. Security groups such as SEAL have already urged victims whose funds reached identified addresses to contact response teams, suggesting active forensic work is under way.

More broadly, hardware wallet security conversations are likely to focus on supply chain hygiene, avoiding unofficial distributors, using neutral delivery locations and never trusting preprinted or reseller supplied seed words. Industry responses, including tightened reseller vetting and stronger packaging authenticity checks, will shape whether this incident is seen as a contained logistics failure or a wider warning about physical distribution risks in self custody.

Conclusion

Ledgers probe into an alleged $86 million reseller linked wallet theft highlights that self custody risk can arise long before a transaction is signed, through compromised logistics and seed handling as much as software bugs. As the investigation clarifies whether CryptoBilis devices were tampered or victims were targeted through other means, the main takeaway for crypto users is to elevate supply chain and recovery phrase hygiene to the same importance as choosing a reputable hardware wallet brand.