- Ledger is investigating reports of cryptocurrency theft involving customers who purchased hardware wallets through Southeast Asian reseller CryptoBilis, after blockchain researchers estimated that suspected losses could exceed $86 million across Bitcoin, Ethereum and Tron.
The hardware wallet manufacturer said on October 9 that it had asked CryptoBilis to suspend all sales and shipments while the investigation continues. Ledger also advised customers who purchased devices from the reseller within the previous 90 days not to initialize unused devices and recommended that customers who had already set them up consider moving their assets to a new device with a newly generated recovery phrase.
The reported $86 million loss figure has not been confirmed by Ledger, and the company has not disclosed how many customers may be affected or how the reported thefts occurred.
CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger said its own infrastructure, systems and services were not compromised and that it had not received reports involving devices purchased directly from the company.
What Is Known About the Reported $86 Million Crypto Theft?
The loss estimates originated with independent blockchain researchers tracking cryptocurrency movements from wallets whose owners reported missing funds.
Researcher tanuki42 initially identified suspected theft addresses associated with more than $72 million in losses. Another investigator, Specter, later estimated that more than $86 million had moved across Bitcoin, Ethereum and Tron addresses.
The estimates remain preliminary. Researchers have not established the precise number of affected wallets, and it is unclear whether every transaction included in the totals is connected to a CryptoBilis purchase. The figures also may not cover identical transactions.
The reports have raised questions about a possible supply-chain attack, in which a product is compromised before it reaches its intended customer. Binance co-founder Changpeng Zhao said the available information suggested a possible issue involving one vendor and that some buyers may have received counterfeit or tampered devices. Ledger has not confirmed that explanation.
Former Mt. Gox chief executive Mark Karpelès also said the reports might be connected to a device-tampering issue he was investigating. He asked potentially affected users to provide photographs of their devices' circuit boards to help establish whether hardware had been altered.
Hardware wallets are designed to keep cryptocurrency private keys offline. However, that protection depends on the security of the device and its setup process. If an attacker obtains a user's recovery phrase, the attacker may be able to access the associated funds without physically possessing the wallet.
There is currently no confirmed evidence that tampered hardware or a compromised recovery phrase caused the reported losses. Ledger's investigation must determine whether the incidents share a common cause and whether the reseller's distribution channel played a role.
The incident adds to a difficult period for cryptocurrency security. In September, crypto exchange Bitget reported unauthorized transfers affecting approximately $351.6 million in digital assets, although that incident involved exchange wallet infrastructure rather than a hardware-wallet reseller.
What Ledger Customers Should Do While the Investigation Continues
Ledger's immediate warning focuses on customers who purchased devices from CryptoBilis during the previous 90 days. Buyers who have not initialized their devices should follow the company's advice not to begin setup while the investigation remains open.
Customers who have already initialized a device purchased through the reseller are being advised to consider transferring their assets to a new Ledger signer using a newly generated recovery phrase. They should consult Ledger's official support channels for current instructions and verify that any guidance comes from the company's genuine website.
Users should never disclose their existing recovery phrase to customer support, investigators or anyone claiming to help recover stolen funds. A legitimate hardware wallet manufacturer should not need a customer's recovery phrase to investigate an incident.
Anyone considering moving assets should take care to initialize the replacement device securely and generate a new recovery phrase through the device's trusted setup process. Simply transferring funds to another address controlled by the same compromised recovery phrase may not provide effective protection.
Customers who believe their funds have been stolen should preserve transaction hashes, wallet addresses, purchase records and relevant communications. These records may help investigators trace the transactions and establish whether the loss is connected to the reported incidents.
The broader issue is the security of the hardware-wallet distribution chain. Buying through an authorized reseller is intended to reduce counterfeit-product risks, but the current investigation has not established whether the devices involved were altered, whether the recovery phrases were exposed or whether another attack method was responsible.
For now, Ledger has confirmed the investigation and the sales suspension, but not the estimated loss amount or its cause. The next significant development will be evidence establishing how the reported wallet drains occurred and whether the incidents can be conclusively linked to devices sold by CryptoBilis.