Ledger-linked exploit drains $86M from wallets

TLDR

A suspected supply-chain issue involving Ledger hardware wallets sold by Southeast Asian reseller CryptoBilis has been linked to reported crypto losses above $86 million, with the cause still unconfirmed.

1. Onchain analysts estimate more than $86 million drained across hundreds of wallets, but investigators and Ledger have not yet confirmed the exact loss or attack vector.
2. Current evidence points to devices bought via CryptoBilis, and Ledger says its own infrastructure and direct-sales devices are not known to be affected.
3. The key next steps are Ledgers investigation findings, movement of the stolen funds, and clearer guidance on how hardware wallet buyers can reduce similar supply-chain risks.

Deep Dive

1. What Happened So Far

Onchain investigator Specter and other researchers traced inflows from hundreds of victim wallets across Bitcoin, Ethereum, Tron and several other networks, estimating losses above $86 million, possibly approaching $100 million, across dozens of addresses. These estimates are described in reports from Coinpedia and TradingView, which cite around $86.96 million spread over 98 addresses, and in follow up analysis that pushes suspected losses toward $93.4 million across more than 400 addresses.

Ledger has acknowledged the reports and said it is investigating wallet drains affecting users in South East Asia who bought devices from reseller CryptoBilis. The company asked CryptoBilis to halt all Ledger sales and shipments while the investigation proceeds and confirmed that, based on information available, the incident appears localized to that reseller and region, according to a Yahoo Finance summary.

Importantly, no article or Ledger statement so far provides definitive proof of a firmware or system-wide Ledger vulnerability. Several outlets, including Bitcoin.com and CoinDesk, note that the attack method, victim count and link between all reported thefts remain unconfirmed.

2. Impact On Users

Ledgers support team has recommended that customers who bought devices from CryptoBilis within the last 90 days avoid setting up unused devices or, if already in use, consider moving assets to a new Ledger device with a freshly generated recovery phrase, as summarized by CoinDesk and Coinpedia. This is a precaution while they determine whether devices or seed phrases could have been compromised somewhere in the resellers supply chain.

Security researchers and industry voices currently view a targeted supply-chain attack on some reseller-sourced devices as the most plausible explanation, rather than a general flaw in Ledgers hardware or software. Bitcoin.com notes that experts see no evidence of a broader Ledger-wide device vulnerability, and that fake or tampered devices could theoretically ship with pre-known recovery phrases or hidden hardware capable of capturing seeds during setup.

3. What To Watch Next

Several things remain unresolved and could change the takeaway for Ledger users and the wider hardware wallet market. First, loss estimates are still moving, with one report from Yfarmx and Bitquery suggesting suspected losses in the low ninety million dollar range, while Chainalysis is reportedly tracking a sophisticated cross-chain laundering operation tied to the stolen funds, according to Bitcoin.coms later coverage.

Second, the key question is whether investigators can conclusively show that devices were tampered with, seeds were exposed through reseller handling, or another mechanism such as phishing or malicious software played the main role. Ledger has promised ongoing updates and has stressed that its own systems and products sold directly are not known to be compromised, per Yahoo Finance and CoinDesk.

Finally, the broader hardware wallet ecosystem will likely respond with tighter reseller controls, stronger guidance on buying directly from manufacturers, and clearer user education about seed handling and transaction approvals.

Conclusion

The reported Ledger-linked wallet drains highlight that even offline hardware protection can be undermined when supply-chain or recovery phrase security breaks down. For now, evidence points to a localized issue involving CryptoBilis-sourced devices, not a confirmed Ledger-wide exploit, but the exact attack path and true loss total remain under investigation. The most useful response for crypto users is to pay close attention to Ledgers official updates, monitor how investigators characterize the root cause, and treat device sourcing and seed handling as critical parts of their overall security model.