TLDR
Ledger is investigating suspected thefts tied to hardware wallets sold by a Southeast Asian reseller, with reported losses around $86 million but no confirmed total or root cause yet.
- Ledger has paused sales via reseller CryptoBilis and warned recent buyers, while saying its own systems and direct sales channels are not known to be compromised.
- Onchain researchers estimate suspected losses between about $72 million and $93 million across Bitcoin, Ethereum, Tron and other networks, but Ledger has not verified these figures.
- For hardware wallet users, the case highlights supply chain and recovery phrase risks and the importance of following official Ledger updates and cautious device purchase practices.
Deep Dive
1. What Ledger Confirmed So Far
Ledger said it is investigating reports that customers in Southeast Asia who bought devices from authorized reseller CryptoBilis lost funds and asked the reseller to halt all sales and shipments while it investigates, advising recent buyers not to set up new devices and activated users to consider migrating to a fresh signer and recovery phrase, according to its support statement summarized by CoinDesk and other outlets, including this investigation report.
In comments cited by CoinMarketCaps community coverage, Ledger said the incident appears isolated to that reseller and region and that its infrastructure, systems and services were not compromised in the event, emphasizing no similar reports from devices bought directly from Ledgers own channels (community summary).
The current investigation focuses on one reseller, and there is no public evidence yet of a global flaw in Ledgers hardware or software stack.
2. Suspected Scale And Attack Pattern
Onchain analysts tanuki42 and Specter have traced inflows from hundreds of victim wallets across Bitcoin, Ethereum and Tron, with initial estimates above $72 million and later estimates above $86 million, approaching about $87 million in one dataset that breaks out roughly $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT, as detailed in reports from The Block and Decrypt (loss estimates overview).
Follow up analysis from investigators and media suggests the suspected total may be higher, with one Bitcoin.com review citing competing counts that reach about $93.4 million across hundreds of addresses and multiple chains, but all of these figures remain third party estimates that Ledger has not yet confirmed (broader loss analysis).
Security researchers and industry figures, including Binance co founder Changpeng Zhao, have floated a localized supply chain attack involving tampered or counterfeit devices as a plausible mechanism, yet published investigations stress that there is still no definitive proof tying a specific hardware modification or recovery phrase capture method to all reported drains (supply chain commentary).
Large dollar figures are circulating, but they are based on wallet clustering rather than a completed forensic report, so there is uncertainty about the exact scale and method.
3. Implications For Hardware Wallet Users
Even if this ultimately proves to be a reseller level supply chain compromise, the case underlines that self custody security depends not just on hardware design but also on how and where devices are acquired, how recovery phrases are generated and stored, and whether any preprinted or reused phrases are involved.
Expert commentary in community and media coverage recommends patterns like buying from trusted sources, inspecting packaging, only using recovery phrases generated securely on device and treating any device with a pre supplied seed as unsafe, but Ledgers own guidance is currently limited to its CryptoBilis warning and general best practice reminders (Ledger focused summary).
For most users, hardware wallets remain a strong self custody option, but the incident is a reminder that distribution channels and recovery phrase hygiene are critical parts of that security model.
Confidence: moderate because key facts come from multiple reputable sources, but Ledger has not yet released a full technical post mortem.
Conclusion
Ledgers ongoing investigation into reseller linked losses around the 86 to 93 million dollar range raises serious supply chain questions without, so far, implicating its core infrastructure or direct sales channels.
Until a detailed technical explanation emerges, the most useful takeaway for crypto users is to treat hardware wallet acquisition and recovery phrase handling as part of the threat model and to follow Ledgers official updates closely for any changes in guidance.
CoinsKid.Com