Ledger halts reseller device sales amid probe

TLDR

Ledger is investigating large crypto losses tied to a Southeast Asian reseller and has halted reseller sales of its hardware wallets while a potential supply-chain attack is probed.

1. Ledger is probing wallet drains linked to reseller CryptoBilis and has asked it to pause Ledger device sales, after losses estimated around $70 million to $90 million.
2. Early findings point to at least one device with an unauthorized hardware implant, raising serious supply-chain concerns but not yet proving a flaw in Ledgers core systems.
3. Crypto users should watch for official Ledger updates, especially guidance for affected buyers and any broader changes to hardware wallet security and reseller policies.

Deep Dive

1. What Ledger Confirmed

Ledger has acknowledged reports of major fund losses from users in Indonesia, Malaysia, and the Philippines who bought hardware wallets from authorized reseller CryptoBilis, also called CryptoBillis. The company says it has no indication that its own infrastructure, systems, or wallet software were breached, and is treating the issue as tied to the reseller rather than its direct channels.

As a precaution, Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices, and the reseller has gone further by suspending all hardware wallet inventory, not just Ledger products, while the investigation continues. Independent on-chain analyses put suspected losses between roughly $72 million and about $93 million across hundreds of addresses holding Bitcoin, Ethereum and stablecoins, figures Ledger itself has not yet verified.

2. Supply-Chain Risk For Users

A key development is that Ledger has confirmed one affected users device contained an unauthorized hardware implant, suggesting physical tampering in the supply chain rather than a remote software exploit. Investigators have documented a modified Ledger Nano device with hidden circuitry that could potentially capture recovery phrases during setup and transmit them, even though the main secure chip remained intact.

So far, this implant has been confirmed on only one device, and it is not yet proven to be the universal cause of all reported thefts. Still, the pattern is consistent with a targeted supply-chain attack: genuine-looking devices, bought from an authorized reseller, that may have been altered before reaching end users. Ledger continues to stress that users should never share their seed phrases and that it will never ask for the 24-word recovery phrase in support interactions.

3. What To Watch Next

For those who purchased Ledger devices from CryptoBilis in the past 90 days, Ledger has advised not to initialize unused devices and to consider moving assets to a new signer with a fresh seed on a trusted device if already in use. Many users are doing this as a precaution until the investigation is complete.

Everyone in the market should watch for Ledgers formal findings: how many devices were tampered with, whether any other resellers or models are affected, what remediation or compensation is offered, and whether regulators treat this as a supply-chain security case. Hardware wallet makers may respond with stronger tamper-evident packaging, stricter reseller vetting, and clearer guidance to buy only via verified channels.

Conclusion

Ledgers halt of reseller device sales highlights that hardware wallet security is not just about cryptography, but also about the physical and distribution path the device travels. Until the probe clarifies how widespread the tampering is, the safest posture is to treat third-party-sourced wallets with caution, favor direct, verifiable purchase routes and maintain strict seed-phrase hygiene while monitoring Ledgers ongoing updates.