Key Takeaways
- • Ledger is investigating reports that users in Southeast Asia who bought hardware wallets from reseller CryptoBilis have lost funds, and has asked CryptoBilis to pause all sales and shipments of Ledger devices.
- • Ledger has urged anyone who bought from the reseller in the past 90 days not to set up their device, and advised those who already have to move assets to a new Ledger signer with a new seed phrase.
- • Pseudonymous investigator Specter tracked theft addresses to roughly $86M-$87M in flows, including about $42M in ETH, $17.6M in BTC and $16.5M in USDT, though Ledger has not confirmed the figure.
- • No tampering has been confirmed, and Ledger has not disclosed the cause of the losses or the number of affected customers.
Summary
Paris-based hardware wallet maker Ledger said on Friday it is investigating reports that users in Southeast Asia who purchased devices from the reseller CryptoBilis have lost funds. In a post on X, the company's support account said that, as a precaution and pending the results of its investigation, it had asked CryptoBilis to pause all sales and shipments of Ledger devices. Ledger advised anyone who bought from the reseller in the past 90 days not to set up their device if they have not already done so, and recommended that those who have already set up devices move their assets to a new Ledger signer with a new seed phrase.
Ledger has not said what caused the losses or how many customers were affected. The company noted that hardware wallets are designed to keep private keys offline, but a device compromised before reaching the buyer, such as one shipped with a recovery phrase an attacker already knows, can leave funds exposed. No tampering has been confirmed. Losses may be substantial, potentially in the tens of millions of dollars.
Pseudonymous crypto investigator Specter said theft addresses flagged in reports from Ledger users on X and Reddit showed inflows from hundreds of victim wallets across Ethereum, Tron and Bitcoin. "Total losses $86M+," Specter wrote. Arkham data shared by the investigator shows nearly $87 million at those addresses, including about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT. Ledger has not confirmed the figure, and it is unclear whether every theft is linked to the reseller.
The incident comes amid a difficult period for crypto security. Rival hardware wallet maker Trezor has faced its own issues, including customer data exposed in a shipping partner breach and a breach of its email last month. Last month, Bitget lost roughly $387 million in a hack that investigators have tied to North Korea, and blockchain analytics firms Chainalysis and Elliptic have since traced part of the proceeds. North Korean hackers also spent six months infiltrating Solana exchange Drift before a $285 million exploit, and Drift has since outlined a plan to repay users. In September, self-described white hat hackers withdrew $320 million in Bitcoin from Blockstream's Liquid sidechain before negotiating with the company.
Ledger has not said what caused the losses or how many customers were affected. The company noted that hardware wallets are designed to keep private keys offline, but a device compromised before reaching the buyer, such as one shipped with a recovery phrase an attacker already knows, can leave funds exposed. No tampering has been confirmed. Losses may be substantial, potentially in the tens of millions of dollars.
Pseudonymous crypto investigator Specter said theft addresses flagged in reports from Ledger users on X and Reddit showed inflows from hundreds of victim wallets across Ethereum, Tron and Bitcoin. "Total losses $86M+," Specter wrote. Arkham data shared by the investigator shows nearly $87 million at those addresses, including about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT. Ledger has not confirmed the figure, and it is unclear whether every theft is linked to the reseller.
The incident comes amid a difficult period for crypto security. Rival hardware wallet maker Trezor has faced its own issues, including customer data exposed in a shipping partner breach and a breach of its email last month. Last month, Bitget lost roughly $387 million in a hack that investigators have tied to North Korea, and blockchain analytics firms Chainalysis and Elliptic have since traced part of the proceeds. North Korean hackers also spent six months infiltrating Solana exchange Drift before a $285 million exploit, and Drift has since outlined a plan to repay users. In September, self-described white hat hackers withdrew $320 million in Bitcoin from Blockstream's Liquid sidechain before negotiating with the company.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.