Ledger probes up to $86M wallet thefts

TLDR

Ledger, the major hardware wallet maker, is investigating large, but still unconfirmed, crypto thefts tied to devices sold via Southeast Asian reseller CryptoBilis.

1. Reports from on-chain investigators put suspected losses between roughly $72 million and $93 million, with the widely cited $86 million figure still not officially confirmed.
2. Evidence so far points to a localized reseller or supply-chain issue, not a proven flaw in Ledgers core hardware, firmware, or Ledger Live software.
3. Crypto users should watch for Ledgers official findings, any confirmed attack method, and industry changes around hardware wallet purchasing and device verification.

Deep Dive

1. What Is Actually Confirmed

Ledger has publicly said it is investigating reports of funds drained from users in Southeast Asia who bought hardware wallets from reseller CryptoBilis, and has asked that reseller to pause sales and shipments as a precaution. News outlets report that on-chain sleuths such as Specter and tanuki42 have traced inflows from hundreds of victim wallets on Bitcoin, Ethereum, Tron and other chains, with early estimates centered around $86 million in losses.

Those figures are not uniform, though. Some trackers have reported totals above $72 million, others near $90 million, and one analysis suggests about $93.4 million across 471 addresses. Ledger has not confirmed any exact number of affected wallets or a final loss total.

2. Likely Cause And Supply-Chain Risk

Current reporting suggests the problem is tied to devices distributed by CryptoBilis, not to Ledgers own manufacturing facilities or software. Ledger has said there is no indication its infrastructure or services were compromised, while several reports describe a suspected supply?chain attack in which some devices or documentation may have been tampered with before reaching customers, for example preknown recovery phrases or hardware implants that capture seed words during setup. Cryptopotato notes that investigators and security researchers are exploring these possibilities and that Ledgers core Secure Element appears to remain intact in examined devices, though causality is not yet proven.

Binance co?founder CZ has publicly framed the incident as a localized reseller problem and urged users to quarantine new hardware wallets, reflecting growing awareness that the physical path from factory to user is now a major attack surface.

3. What To Watch And How To Think About Hardware Safety

Key next steps for users and markets are:

1. Ledgers formal incident report, which should clarify whether hardware tampering, counterfeit units, stolen seed phrases, or sophisticated phishing were responsible.
2. Whether major analytics firms like Chainalysis, which are already investigating cross?chain laundering linked to the drains, publish a convergent loss estimate and victim count.
3. How hardware wallet vendors tighten their reseller policies, packaging, and user guidance, and whether large holders move more decisively toward buying only direct?from?manufacturer, with extra scrutiny of new devices.

For everyday crypto users, this episode reinforces some high?level rules: buy hardware wallets only through trusted channels, treat third?party resellers as higher risk, and be extremely cautious about any situation that exposes or requests your recovery phrase.

Conclusion

Ledgers probe into up to $86 million in suspected wallet thefts is a serious hardware wallet security event, but it currently looks concentrated in one resellers supply chain rather than a proven failure of Ledgers core technology. Until Ledger and independent investigators pin down the exact attack path and a reliable loss figure, the practical takeaway is to elevate supply?chain security, scrutinize how devices are acquired and initialized, and monitor official updates before drawing conclusions about hardware-based self?custody as a whole.