Ledger asks reseller to halt device sales

TLDR

Ledger has asked Southeast Asian reseller CryptoBilis to halt hardware wallet sales while it investigates major wallet drains linked to devices sold through that channel.

1. Ledger is probing reported losses near $90 million affecting customers who bought wallets from CryptoBilis and has paused that resellers sales.
2. Early evidence points to possible tampered devices in the reseller supply chain, while Ledger says its core infrastructure shows no sign of compromise.
3. Hardware wallet users should focus on secure sourcing, seed protection and updates from Ledger as this investigation unfolds.

Deep Dive

1. Reseller Sales Halt And Incident Scope

Reports from multiple outlets say users in Indonesia, Malaysia and the Philippines who bought Ledger devices from authorized reseller CryptoBilis have suffered coordinated wallet drains, with estimates around $90 million across Bitcoin, Ethereum and stablecoins.Finbolds incident summary notes that on 9 Oct Ledger told customers who purchased from CryptoBilis in the past 90 days not to initialize unused devices and to consider migrating funds if already set up.

Ledger also asked CryptoBilis to pause all sales and shipments of Ledger devices while the investigation continues.TradingViews recap and The Defiants coverage both confirm this reseller sales halt. CryptoBilis has since stopped selling all hardware wallets pending the outcome.

2. Suspected Supply-Chain Tampering, Not Core Breach

Ledger states it has no indication that Ledgers security infrastructure, systems or services have been compromised, framing the issue as localized to devices distributed via CryptoBilis.Bitcoin.coms report details that one affected customers wallet contained an unauthorized hardware implant, strongly suggesting physical tampering before the device reached the user.

Separate analysis by firms such as Bitquery has traced patterns of test transactions and synchronized outflows across hundreds of addresses, consistent with a common point of control, but the exact attack method is still unconfirmed.U.Todays breakdown stresses that the widely cited 92.9 million loss figure is independent and not yet validated by Ledger.

3. Practical Implications For Hardware Wallet Users

For crypto users, the key risk here is supply-chain integrity rather than the abstract security model of hardware wallets. A device that looks genuine can still be dangerous if modified before sale to capture seed phrases or intercept setup flows, as the reported implant case illustrates.The Defiants account of the implant underscores that even tamper-evident packaging might not be sufficient against sophisticated physical mods.

Many users respond to incidents like this by buying directly from the manufacturer or well vetted channels, closely inspecting packaging, and treating their 24-word recovery phrase as the ultimate secret that must never be shared or typed anywhere else. Watching for Ledgers future updates on anti-tampering measures and any compensation or remediation plan will be important.

Confidence: high because multiple independent reports align with Ledgers own public statements, although the precise attack method and total losses remain unconfirmed.

Conclusion

Ledgers request that CryptoBilis halt device sales is a precautionary move in response to large, likely coordinated thefts that appear tied to one resellers hardware rather than a systemic failure of Ledgers core systems.

Until investigators fully map the attack and confirm whether more devices are affected, the safest posture for users is to treat hardware wallet security as a full chain, from manufacturing and distribution to how seed phrases are handled, and to follow Ledgers ongoing guidance as this case develops.