Ledger probes reseller-linked drains over $80M

TLDR

Ledger is investigating suspected crypto wallet drains of over $80 million tied to Southeast Asian reseller CryptoBilis, with no evidence so far of a global Ledger infrastructure hack.

1. Reports link more than $80 million, possibly up to about $90 million, in losses to wallets initialized on devices bought from CryptoBilis, while Ledger has frozen that resellers shipments.
2. Investigators suspect a localized supply chain compromise or tampered devices, but the exact attack vector, number of victims and final loss total remain unconfirmed.
3. Hardware wallet users should watch for official Ledger updates and tighten self?custody hygiene, especially when buying through resellers rather than directly from manufacturers.

Deep Dive

1. Reported Losses And Ledgers Response

Ledger said it is probing reports of drained wallets affecting users in Indonesia, Malaysia and the Philippines who purchased devices from authorized reseller CryptoBilis, and has asked that reseller to pause all sales and shipments while the investigation continues. In posts and media reports, Ledger advised anyone who bought from CryptoBilis in roughly the past 90 days not to initialize unused devices and suggested that users who already set them up consider moving funds to a new Ledger signer with a new recovery phrase. On chain researchers such as Specter and tanuki42 have tracked flows that suggest losses above $72 million and possibly around $86 million or more across Bitcoin, Ethereum and Tron, although Ledger has not confirmed any specific figure or victim count yet.

2. Suspected Supply Chain Attack, Not A Platform Hack

Ledger has stated that its own infrastructure, firmware and Ledger Live software have not been compromised, and early analysis points instead to a reseller level issue involving CryptoBilis. Investigators and commentators, including Binance co founder Changpeng Zhao, have described this as a likely localized supply chain attack in which some devices may have been counterfeit or tampered with before reaching customers, for example by inserting pre generated seed phrases or hidden hardware modules. Other possibilities remain on the table, including phishing or malicious approvals, and there is no public proof yet that every affected wallet used a compromised device, which is why multiple outlets stress that the supply chain explanation is a leading hypothesis rather than a confirmed root cause.

3. What Users Should Watch And Practical Precautions

Several analytics firms, including Arkham, Bitquery and MistTrack, have published rising loss estimates that now cluster in the low to mid ninety million dollar range, and some report that Tether has frozen USDT at addresses linked to the suspected thefts. Security group SEAL has invited potential victims to contact its incident response team, while Ledger has signaled that a fuller public update will follow once its internal and on chain investigations converge. For self custody users, especially in high value brackets, practical precautions now include buying directly from manufacturers when possible, inspecting packaging and authenticity checks, never entering seed phrases into apps or websites, and initially funding new devices with small balances only until they have soaked for some time without suspicious activity.

Conclusion

The emerging picture is of a serious but likely localized compromise tied to a specific reseller, with estimated losses already above $80 million and possibly near $90 million across several chains. As investigators work toward a confirmed root cause, the main lesson for crypto users is that self custody security depends not just on hardware design, but also on the integrity of the supply chain and setup practices around it.