Ledger investigates reseller wallets amid $86M losses

TLDR

Ledger is investigating reports that users who bought its hardware wallets from Southeast Asian reseller CryptoBilis had their crypto drained, with onchain estimates putting potential losses around $72 million to $90 million.

1. Onchain investigators link hundreds of drained wallets tied to devices sold by CryptoBilis, with estimated losses above $86 million that Ledger has not yet confirmed.
2. Current evidence points to a localized reseller or supply chain issue, not a confirmed Ledger-wide hardware or infrastructure compromise.
3. Ledger has frozen sales via CryptoBilis and urged recent buyers to avoid using those devices and to migrate funds to new wallets with freshly generated recovery phrases.

Deep Dive

1. What Happened And How Big Is It?

Multiple reports describe users in Indonesia, Malaysia and the Philippines who bought Ledger devices from reseller CryptoBilis and later saw funds drained without signing obvious malicious transactions. Ledger acknowledged these reports in an X statement and opened an investigation, asking CryptoBilis to halt sales and shipments while it probes the issue.

Pseudonymous onchain researchers such as Specter have traced inflows from hundreds of victim wallets across Bitcoin, Ethereum, Tron and stablecoins, estimating potential losses between about $72 million and $86 million or more, though Ledger has not verified these figures and they may overlap across estimates. Outlets including CoinDesk and Cointelegraph report similar ranges and highlight that the precise number of victims and total value remain uncertain.

2. Ledger-Wide Hack Or Localized Supply Chain Issue?

Ledger states that, based on current information, there is no indication its core infrastructure, systems or services were compromised, and that reports are confined to devices sold via CryptoBilis in Southeast Asia, as noted by Yahoo Finance. That reduces the likelihood of a global firmware or protocol level flaw affecting all Ledger users.

Several analysts and security researchers instead discuss potential supply chain scenarios, such as counterfeit or physically tampered devices with recovery phrases or implants known to attackers, although none of these mechanisms are confirmed. Coverage from CryptoPotato and others stresses that there is still no proof that every affected wallet is tied to CryptoBilis, nor that a single exploit explains all losses.

3. How Ledger And Users Are Responding

Ledger has asked CryptoBilis to pause all Ledger device sales and shipments while the investigation continues. Its support guidance is targeted at customers who bought from this reseller in the last 90 days, advising them not to initialize unused devices and to consider moving assets to a new Ledger signer with a newly generated recovery phrase, as detailed by Cointelegraph.

On the defensive side, some stablecoin issuers have reportedly frozen suspect USDT at addresses linked to the drains, and onchain sleuths are maintaining public address lists to track movement of the stolen funds, according to CryptoPotato. For now, there are no reports that devices bought directly from Ledger or other authorized channels outside CryptoBilis are impacted.

Conclusion

Ledgers probe into suspected $80 million plus losses tied to CryptoBilis reseller devices highlights how hardware wallet risk can cluster in distribution channels rather than in core protocols. For crypto users, the key is not panic about all hardware wallets, but tightening operational hygiene and sourcing habits while watching for Ledgers final findings on whether this was counterfeit hardware, tampering, social engineering, or a mix of factors.