Ledger has suspended sales and shipments through Southeast Asian reseller CryptoBilis following suspected wallet compromises that resulted in estimated cryptocurrency losses ranging from more than $72 million to nearly $90 million. The hardware wallet manufacturer is investigating the incident, which security researchers believe may involve counterfeit or tampered devices distributed through the reseller rather than a vulnerability in Ledger's software.
Ledger has instructed CryptoBilis to halt all sales and shipments pending the investigation's outcome. Customers who purchased devices through the reseller within the past 90 days have been advised not to initialize unused wallets. Those already using affected-channel devices have been urged to transfer their assets to a new Ledger device initialized with a new recovery phrase.
The financial impact remains uncertain, with blockchain investigators reporting different estimates as additional compromised wallets are identified. On-chain analyst Specter traced ten collection addresses receiving funds from hundreds of victim wallets across Ethereum, TRON and Bitcoin, calculating losses exceeding $86 million while the total continued to rise. Analyst tanuki42 estimated losses above $72 million, while blockchain security platform MistTrack placed the figure at nearly $90 million.
Ledger has not confirmed a monetary loss figure, leaving the estimates dependent on independent blockchain tracing rather than an official accounting. The involvement of multiple networks also complicates the investigation, as stolen assets can be transferred, exchanged or consolidated across different addresses before investigators establish the full extent of the theft.
CryptoBilis identifies itself as an authorized Ledger reseller in Malaysia and distributes hardware wallets across Indonesia, Malaysia and the Philippines. The company has not responded to a request for comment. Ledger's decision to suspend distribution through the reseller places the immediate focus on the integrity of devices sold through that channel and whether compromised products can be identified before additional customer funds are exposed.
The suspected attack mechanism is particularly important because it points toward a potential distribution-chain compromise rather than a failure of Ledger's underlying wallet software. Binance founder Changpeng Zhao said the available evidence suggests a supply-chain attack involving a single vendor, potentially affecting a relatively small number of customers who purchased counterfeit or modified devices. That assessment remains preliminary and does not establish how the devices may have been compromised.
Security researcher Taylor Monahan also rejected suggestions that the incident involved a previously unknown software vulnerability, or zero-day, in Ledger products. Monahan warned that customers reacting hastily by moving funds could expose themselves to phishing attacks, potentially creating additional losses unrelated to the original compromise. The distinction matters because replacing a potentially compromised device requires careful recovery-phrase management rather than simply transferring assets under pressure.
Blockchain tracking indicates that some of the stolen assets have already entered laundering channels. Approximately 430 ETH, valued at roughly $1.07 million, has reportedly passed through Tornado Cash, a cryptocurrency mixing protocol that can obscure transaction trails. Meanwhile, wallets tracked by Arkham and linked to the suspected thefts still hold approximately $70.6 million, suggesting a substantial portion of the identified funds remains visible on-chain.
Stablecoin intervention has also become part of the incident. Tether froze USDT associated with addresses linked to the thefts, after which the suspected attacker began exchanging USDT for USDD, a TRON-based stablecoin outside Tether's direct freezing authority.
The shift illustrates how asset-level controls can disrupt access to certain stolen funds while potentially encouraging attackers to move into tokens governed by different issuers.
For the digital-asset custody industry, the incident highlights a security risk that extends beyond cryptographic protections and wallet software. Hardware wallets depend on the integrity of physical devices, recovery-phrase generation and trusted distribution channels. If the suspected tampering is confirmed, the case would demonstrate how weaknesses in product distribution can undermine otherwise secure self-custody arrangements.
The immediate priority is determining how many CryptoBilis-distributed devices were affected, whether the suspected compromise was limited to one reseller and how much of the stolen cryptocurrency can be recovered or immobilized. Investigators will also need to reconcile the competing loss estimates as additional addresses and transactions are identified. Ledger's findings on the suspected distribution-chain compromise, together with movements from the approximately $70.6 million in tracked holdings, will be central to assessing the final financial impact and whether further customer protection measures are required.
