Ledger investigates $93M reseller wallet drain

TLDR

Ledger is probing a large wallet drain, estimated around 90 to 93 million dollars, tied to hardware wallets sold by Southeast Asian reseller CryptoBilis.

1. Investigators link hundreds of drained wallets across multiple chains to devices bought from CryptoBilis, but Ledger says its own infrastructure is not confirmed as compromised.
2. On chain patterns and at least one device with an unauthorized hardware implant point to a localized supply chain or tampered hardware issue that undermines self custody assumptions.
3. Affected users are urged not to initialize recently bought devices and to migrate funds to new wallets with fresh seed phrases, while the broader community rechecks hardware sourcing and security hygiene.

Deep Dive

1. What Happened So Far

Reports suggest roughly 90 to 93 million dollars were drained from 300 to 470 plus wallets across TRON, Bitcoin, Ethereum, BNB Chain and Polygon after users bought devices from CryptoBilis in Indonesia, Malaysia and the Philippines. Estimates from Bitquery and other investigators cluster around 92.9 to 93.4 million dollars, but Ledger has not formally confirmed a final loss figure or the exact number of affected addresses. Ledger asked CryptoBilis to pause all sales and shipments and publicly advised customers who bought devices there in the last 90 days not to initialize unused devices and to consider moving assets to a new signer with a new seed phrase, while Tether reportedly froze about 10 million dollars in USDT linked to suspect wallets.

2. Supply Chain And Hardware Risk

Ledger states there is no indication that its core security infrastructure, systems or services were breached, shifting focus to how devices reached users and what may have been modified in transit. At least one affected users device was found to contain an unauthorized hardware implant, according to a Ledger update reported by The Defiant, which is consistent with concerns about tampered devices sold through third parties. On chain analysis shows coordinated draining patterns and cross chain laundering, and several experts view a localized supply chain attack or counterfeit units through CryptoBilis as the most plausible scenario, although this remains unproven and Ledgers investigation is ongoing.

3. Practical Steps For Users

For customers who bought Ledger devices from CryptoBilis in roughly the past 90 days, current guidance is to avoid initializing unused units and to migrate funds from active units to a new wallet generated on a trusted device with a completely new recovery phrase. More broadly, crypto users should prefer buying hardware wallets directly from the manufacturer or a highly vetted channel, verify packaging and device authenticity, and never reuse old seed phrases on new hardware. Given rising sophistication in phishing and hardware tampering, ongoing vigilance against unsolicited devices, support emails and any request for a recovery phrase is as important as chain level security.

Conclusion

The reseller linked Ledger wallet drain highlights that self custody security depends not only on cryptography and firmware but also on how hardware is sourced and initialized. Until Ledger and investigators fully map the attack path, the most sensible response is tightening procurement and seed practices, treating third party devices and sudden support contacts with extreme caution while monitoring official Ledger communications for definitive findings and remedial steps.