Ledger investigates reseller-linked crypto theft reports

TLDR

Ledger is probing reports that tens of millions of dollars in crypto were drained from wallets linked to a Southeast Asian reseller, with the incident so far appearing localized and still under investigation.

1. Ledger is investigating losses estimated between 72 million and 90 million dollars tied to devices sold by reseller CryptoBilis in Indonesia, Malaysia and the Philippines.
2. The company says its own infrastructure is not breached, and current guidance focuses on customers who bought devices from CryptoBilis in the last 90 days.
3. The episode highlights hardware wallet supply chain risk and is pushing the industry toward stricter reseller controls and quarantine practices for new devices.

Deep Dive

1. Scale And Status Of The Incident

Multiple reports say users who bought Ledger devices from Southeast Asian reseller CryptoBilis have seen funds drained across Bitcoin, Ethereum, Tron and stablecoins, with on chain estimates ranging from more than 72 million to over 86 million dollars in suspected thefts.Ledger investigation overview

Researchers such as tanuki42 and Specter have traced inflows to clusters of theft addresses, but Ledger has not confirmed the figures, the number of victims, or that all affected wallets are tied to CryptoBilis.Researcher estimates

The investigation is ongoing, and there is no confirmed evidence yet of a global Ledger firmware or infrastructure exploit; the focus remains on a reseller channel in Southeast Asia.Company statement

2. Who Is Affected And Ledgers Guidance

Ledger has instructed CryptoBilis to halt all sales and shipments while it investigates and has issued specific guidance to customers who bought from that reseller within the past 90 days.Ledger support notice

Those users are being told not to initialize unused devices and to consider moving assets to a new Ledger signer with a newly generated recovery phrase, ideally on a device obtained through verified channels.Customer advisory

Ledger states that its infrastructure, systems and services were not compromised and that it has seen no reports involving devices purchased directly from the manufacturer or other authorized retailers.Infrastructure reassurance

3. Hardware Wallet Supply Chain Lessons

Security researchers and Binance co?founder Changpeng Zhao have framed the incident as a likely supply chain attack, where counterfeit or tampered devices or documentation expose recovery phrases before the user ever transacts.CZ commentary

Further reporting suggests some seized devices may have hidden hardware implants or preprinted seed phrases that allow attackers to capture or reuse the wallets backup words.Tampered device details

Industry responses now emphasize buying hardware wallets directly from manufacturers, verifying packaging and firmware, and treating new devices with a quarantine period before trusting them with large balances.Reseller risk analysis

Conclusion

Ledgers reseller?linked theft investigation shows that even well?known hardware wallets can be undermined if attackers compromise distribution, rather than the wallet software itself.

For now, evidence points to a localized problem at CryptoBilis, but the unresolved cause and large reported losses make supply chain security a central topic for anyone using hardware wallets to safeguard significant crypto holdings.