Ledger suspends reseller sales after theft reports

TLDR

Ledger has frozen hardware wallet sales through a key Southeast Asian reseller after reports that tampered devices from that reseller are linked to a major theft of user funds.

1. Ledger is investigating wallet drains estimated around 70 to 90 million dollars among users who bought devices from reseller CryptoBilis in Indonesia, Malaysia, and the Philippines.
2. The leading theory is a localized supply chain attack involving physically modified devices, while Ledger says its own infrastructure and software show no signs of compromise.
3. Customers who recently bought Ledger devices via this reseller are told not to set them up and to consider migrating funds, and all users are urged to tighten basic hardware wallet safety practices.

Deep Dive

1. What Ledger Has Done

Several reports describe coordinated wallet drains affecting hundreds of addresses owned by users who purchased Ledger hardware wallets from authorized reseller CryptoBilis in Southeast Asia, with independent estimates clustering near 90 million dollars in losses across Bitcoin, Ethereum, TRON, BNB Chain, Polygon, and stablecoins such as USDT and USDC.

In an official statement quoted by multiple outlets, Ledger said it is investigating these losses and asked CryptoBilis to pause all sales and shipments of Ledger devices for customers in the region, while advising anyone who bought from that reseller in the past 90 days not to initialize unused devices and to consider moving funds off already initialized ones to a new device with a new seed phrase. CryptoBilis has since stopped selling all hardware wallet inventory pending the investigation, broadening the pause beyond Ledger branded products.

2. Suspected Attack And What Is Not Compromised

On October 10, Ledger confirmed that at least one affected customers device contained an unauthorized hardware implant, strongly suggesting a physical tampering or supply chain attack focused on CryptoBilis sourced devices rather than a software bug in Ledgers own firmware or backend. Investigators and independent researchers have documented a modified Ledger Nano X with extra circuitry and cellular components that could, in theory, capture recovery words during setup and exfiltrate them, which would allow attackers to drain funds later.

Despite this, Ledger states it has no indication that its core security infrastructure, systems, or services have been breached, and the exact method used in all cases remains unconfirmed. Estimates of the total stolen vary by analyst and have not been formally verified by Ledger, but the pattern points to a highly targeted scheme against a specific reseller channel rather than a global failure of Ledger devices.

3. User Impact, Safety, And What To Watch

The most immediate risk is for users who purchased Ledger hardware wallets from CryptoBilis (also known as CryptoBillis), especially within roughly the last three months. Ledger has asked those users not to initialize unused devices and, if they already set them up, to consider moving assets to a fresh Ledger signer with a brand new recovery phrase, since any seed that might have been exposed is permanently unsafe.

For all hardware wallet users, this incident reinforces basic operational security: buy devices directly from the manufacturer or highly trusted channels, inspect packaging for signs of tampering, never share your 24 word recovery phrase with anyone, and treat unexpected support contacts as potential scams. Going forward, key things to watch are Ledgers final incident report, any broader recall or compensation measures, and whether investigations uncover more tampered devices or additional resellers.

Conclusion

Ledgers suspension of reseller sales is a precautionary response to what appears to be a localized but severe supply chain compromise, not a proven failure of its core technology. The main takeaway for crypto users is that secure self custody depends as much on how and where you source your hardware wallet as on the wallet brand itself, and that vigilance around devices, recovery phrases, and support interactions can significantly reduce the chance of similar attacks succeeding.