Ledger is investigating reports of cryptocurrency theft linked to hardware wallets sold by CryptoBilis, a reseller in Southeast Asia. The reported losses could exceed $86 million and involve hundreds of wallets, although the amount and number of affected users have not been independently confirmed.
The reports emerged after users began reporting missing funds. Suspected theft addresses were identified across Bitcoin, Ethereum, and Tron, but it remains unclear whether the incidents are connected or what caused the losses.
As a precaution, Ledger has asked CryptoBilis to suspend all sales and shipments while the investigation continues. Customers who purchased devices through the reseller within the past 90 days have been advised not to set them up.
Customers who have already activated their wallets have also been advised to consider transferring their assets to a new Ledger device using a newly generated recovery phrase. This step may help reduce potential risks while the investigation is ongoing.
One possible explanation is a supply-chain attack, in which a device is tampered with before reaching the customer. For example, an attacker could provide a wallet with a recovery phrase they already know, potentially allowing them to access funds deposited later.
However, there is currently no confirmation that device tampering or pre-generated recovery phrases caused the reported thefts. The incident also does not establish that Ledger's own systems were compromised.
The potential losses come amid a series of major security incidents across the cryptocurrency industry. Recent reported exploits have affected platforms and protocols including Bitget, Liquid Network, Drift, and Kelp, highlighting the financial risks associated with security failures.
For now, the cause of the Ledger-related reports remains unknown. The investigation must establish whether the affected devices share a common vulnerability, how many customers were impacted, and whether the reported losses are connected.
