Ledger investigates reports of $86M crypto thefts

TLDR

Ledger is investigating large, unconfirmed crypto thefts, estimated around $86 million, affecting customers who bought its hardware wallets from Southeast Asian reseller CryptoBilis.

1. Reports link tens of millions of dollars drained from hundreds of wallets to devices sold by CryptoBilis, while Ledger says its own infrastructure was not breached.
2. A reseller supply chain compromise and possibly tampered devices are the leading theories, raising questions about hardware wallet safety when bought outside fully controlled channels.
3. The key next signals are Ledgers formal findings, law enforcement action, and whether tracking firms and issuers like Tether can materially contain or recover any stolen funds.

Deep Dive

1. What Is Known So Far

Multiple on chain analysts, including Specter and tanuki42, have traced inflows from hundreds of victim wallets across Bitcoin, Ethereum and Tron, with loss estimates ranging from about $72 million to over $90 million; the widely cited figure is $86M+.

Ledger has confirmed that it is investigating reports of lost funds from Southeast Asian users who bought devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines, and has asked that reseller to pause all sales and shipments while the probe continues.

In public statements summarized by outlets such as Cointelegraph and CoinsKid community posts, Ledger has said its infrastructure, systems and services were not compromised and that the incident appears isolated to that reseller channel, but it has not verified any loss totals or disclosed a definitive cause.

2. Likely Cause And Hardware Wallet Risk

Investigators and commentators, including Binance founder Changpeng Zhao, currently see a localized supply chain attack as the most credible explanation, meaning counterfeit or physically tampered devices or documentation at the reseller or its warehouses rather than a remote software exploit.

Analysis cited by CryptoPotato and CoinsKid community reports describes scenarios where attackers intercept devices, alter packaging or seed phrase materials, or even add hidden hardware modules that can capture recovery phrases during setup, while Ledgers Genuine Check still passes because the secure element chip remains genuine.

This does not imply that all Ledger devices are unsafe, but it highlights that self custody security depends on both the device design and the integrity of the hardware and documentation from manufacturing through delivery, especially when using third party resellers.

3. What To Watch Next

Key near term developments are Ledgers full incident report, which should clarify whether devices or seed materials were compromised and how broadly, and whether the company changes its reseller model or verification procedures.

On chain, firms like MistTrack, Bitquery and Chainalysis are tracking complex laundering patterns, while issuers such as Tether have reportedly frozen some USDT at suspected attacker addresses, which can limit further movement but does not automatically reimburse victims.

If law enforcement becomes more overtly involved and loss estimates converge, it will signal how seriously regulators treat hardware wallet supply chain compromises and may shape new standards for packaging, distribution and user verification across the industry.

Conclusion

The reported Ledger reseller incident is a serious but still unresolved case of large scale wallet drains that appears tied to a specific Southeast Asian distribution channel rather than a universal device flaw.

For crypto users, the main takeaway is that hardware wallets remain a cornerstone of self custody, yet their security relies on trusted sourcing and careful handling of seed phrases, not just on the device brand or firmware.