Ledger Probes $86M+ Crypto Theft Linked to Southeast Asian Reseller

Ledger, the Paris-based hardware wallet manufacturer, is investigating reports of significant fund losses from users in Southeast Asia. The company has focused its inquiry on devices purchased from a reseller named CryptoBilis, with an on-chain investigator estimating potential thefts exceeding $86 million.

As a precautionary measure, Ledger has instructed CryptoBilis to halt all sales and shipments of its devices while the investigation proceeds. The company's support account on X advised anyone who acquired a Ledger device from CryptoBilis within the last 90 days to refrain from setting it up if they have not already done so. For those who have already configured their devices, Ledger recommends moving their digital assets to a new Ledger signer secured by a freshly generated seed phrase.

A seed phrase, often a sequence of 12 or 24 words, acts as the master backup for a cryptocurrency wallet, capable of regenerating its private keys. Hardware wallets are fundamentally designed to keep these critical private keys offline, safeguarding them from online threats. Ledger has not yet confirmed the specific cause of the reported losses or the total number of affected customers, but acknowledged that a device compromised before it reaches the buyer, such as one shipped with a pre-known recovery phrase, could expose funds.

Scope of the Alleged Losses

The scale of the reported losses appears substantial. Pseudonymous crypto investigator Specter stated they traced theft addresses flagged in reports from Ledger users on platforms like X and Reddit. Specter identified inflows from hundreds of victim wallets spanning major blockchains including Ethereum, Tron, and Bitcoin, estimating total losses at over $86 million.

Data shared by the investigator from Arkham intelligence indicates nearly $87 million at these addresses. This figure includes approximately $42 million in Ether (ETH), $17.6 million in Bitcoin (BTC), and $16.5 million in Tether (USDT). Ledger has not officially confirmed Specter's figures, and it remains unclear whether every identified theft is definitively linked to the CryptoBilis reseller.

Why it matters

This incident underscores the persistent security challenges within the cryptocurrency ecosystem, even for products designed to offer enhanced protection. Hardware wallets are widely considered one of the most secure methods for storing digital assets, and any potential compromise, particularly through a supply chain vector, could erode user confidence. The integrity of the supply chain for hardware wallets is paramount, as a device tampered with before reaching the end-user bypasses the core security promise of offline key storage.

The episode follows a challenging period for crypto security. Last month, the Bitget exchange reportedly lost around $387 million in a hack, which investigators have linked to North Korea. Similarly, North Korean hackers are believed to have infiltrated the Solana-based exchange Drift for six months before a $285 million exploit. In a separate event, self-described white hat hackers withdrew $320 million in Bitcoin from Blockstream’s Liquid sidechain in September before negotiating with the company for its return. Rival hardware wallet maker Trezor has also faced its own security incidents, including a customer data exposure via a shipping partner and an email breach last month.

What to watch

Investors and users will closely monitor Ledger's ongoing investigation for definitive findings regarding the cause of the losses and the extent of CryptoBilis's involvement. The company's response and any proposed remedies for affected users will be crucial for maintaining trust in its products. The wider hardware wallet industry may also face increased scrutiny regarding supply chain security protocols. The market reaction to these reports, with Bitcoin currently trading around $82,824, suggests a degree of resilience, though continued security concerns could weigh on broader sentiment.