Ledger pauses reseller sales after theft reports

TLDR

Ledger has asked its Southeast Asian reseller CryptoBilis to stop selling hardware wallets while it investigates large thefts linked to devices sold through that channel.

1. Reports suggest up to about $90 million was drained from wallets of users who bought Ledger devices from CryptoBilis, but the exact total and attack method remain unconfirmed.
2. Ledger says its own systems are not breached and evidence now points to at least one physically tampered device, raising supply chain and reseller risk rather than a core wallet software flaw.
3. Affected users are being told not to set up recent devices and to move funds to a fresh wallet, while the industry watches for broader changes to hardware wallet security and reseller practices.

Deep Dive

1. What Happened At The Reseller

Multiple investigations report large wallet drains affecting customers in Indonesia, Malaysia and the Philippines who bought Ledger hardware wallets from authorized reseller CryptoBilis, with loss estimates clustering around $72 million to $93 million across BTC, ETH, TRON, stablecoins and other assets. Sources such as CryptoPotato and Bitquery cite figures near $86 million and $92.9 million, though Ledger has not validated these totals.

In response, Ledger publicly stated it is investigating reports of lost funds from users who purchased via CryptoBilis and asked the reseller to pause all sales and shipments of Ledger devices in Southeast Asia. A later update confirms CryptoBilis has halted all hardware wallet inventory, not just Ledger, pending the outcome of the investigation.

2. Evidence Of Tampering And User Risk

Ledger has repeatedly said it has no indication that its security infrastructure, systems or services were compromised, pointing attention to possible physical tampering of devices sold through the reseller rather than a software or firmware flaw. That view gained weight when Ledger confirmed that one affected customers device contained an unauthorized hardware implant.

Security reports describe a modified Ledger Nano X with a concealed circuit board and cellular components that could potentially capture the recovery phrase shown on the device screen during setup and transmit it over a mobile connection. This would let attackers reconstruct the private keys without breaking Ledgers secure element, fitting a supply chain attack pattern. However, investigators have not yet proved that all drained wallets used similarly modified devices.

3. Guidance For Users And Next Developments

Ledger advises anyone who bought its devices from CryptoBilis in the last 90 days and has not yet initialized them to avoid setup for now, and recommends that users who already configured such devices move their assets to a new Ledger signer with a freshly generated seed phrase, as summarized in a community update. Stablecoin issuers have begun reacting, with Tether reportedly freezing around $10 million in USDT linked to suspected theft addresses, while some funds were swapped into USDD to move beyond those controls.

Key unknowns include the number of compromised devices, the exact attack chain and whether other resellers or regions are affected. Next important signals will be Ledgers final forensic findings, any compensation or remediation program, and whether hardware wallet makers tighten anti tamper features and reseller vetting across the industry.

Conclusion

Ledgers pause of reseller sales reflects a serious, likely localized supply chain compromise rather than a proven failure of its core wallet design. The incident underscores that even offline hardware security depends on trusted manufacturing and distribution. For crypto users, the practical takeaway is to prioritize verified purchase channels, treat seed phrases as ultimate keys and stay alert to future findings that might expand or narrow the scope of risk around this case.