Ledger investigates reseller-linked crypto theft reports

TLDR

Ledger is investigating reports of major crypto thefts linked to hardware wallets sold by its Southeast Asian reseller CryptoBilis, with estimated losses in the tens of millions of dollars.

1. On chain analysts currently estimate 72 to 87 million USD stolen from affected wallets, but the figures and direct link to CryptoBilis remain unconfirmed.
2. Ledger has halted sales via CryptoBilis and warned recent buyers not to initialize those devices while saying its own systems and firmware appear uncompromised.
3. The incident highlights hardware wallet supply chain risk, so crypto users may want to favor verified purchase channels and watch for official Ledger security updates.

Deep Dive

1. Scale Of Reported Losses

On chain researchers tanuki42 and Specter have traced inflows to theft linked addresses across Bitcoin, Ethereum and Tron, with estimates ranging from more than 72 million to almost 87 million USD in stolen assets, according to tracking cited by Finance Yahoo and Arkham data.

These numbers are still third party estimates. Ledger has not confirmed the totals, how many wallets are affected, or whether all reported drains are tied to the same reseller or attack pattern.

Confidence: moderate. Cause and total losses are still being investigated and unconfirmed.

2. Ledgers Response So Far

Ledgers support account said it is investigating losses reported by customers who bought devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, and asked the reseller to pause all sales and shipments while the probe continues. This precautionary pause is documented in Ledgers statement relayed by Cointelegraph and other outlets.

The company has advised customers who bought from CryptoBilis in the last 90 days not to set up unused devices and suggested that those already using them consider moving assets to a new Ledger signer with a freshly generated recovery phrase, as summarized by Ledgers guidance to affected users. Ledger has also said its infrastructure, systems and Ledger Live software have not been compromised and that incidents appear isolated to that reseller and market.

3. Supply Chain Risk And What To Watch

Security researchers and Binance co founder CZ have pointed to a likely supply chain angle, where counterfeit or tampered devices from a reseller could ship with recovery phrases already known to attackers, rather than a flaw in Ledgers core wallet technology, as noted in CZs comments on a localized reseller breach.

For crypto users, the practical risk is that even a reputable hardware brand can be undermined if the physical device is altered before it reaches the buyer. Watching for Ledgers final incident report, any confirmation of tampered hardware or phishing, and whether losses remain confined to CryptoBilis sourced devices will be key to understanding the true scope.

Conclusion

This investigation suggests a serious, but likely localized, compromise affecting Ledger devices sold through one Southeast Asian reseller rather than a global failure of Ledgers technology.

Until Ledger publishes a full post mortem, the safest stance is to treat third party hardware channels as a potential weak link and let official security updates guide any changes to your self custody setup.