Ledger Probes Reported $80M+ Crypto Theft Tied to Reseller
In this article
Ledger has opened an investigation into reports that customers in Southeast Asia lost crypto funds after buying its hardware wallets from CryptoBilis, an authorized reseller based in Malaysia. U.today reported that the French hardware wallet maker confirmed the probe on Friday and has asked the reseller to stop selling and shipping its devices until the review ends.
The story escalated quickly as industry figures weighed in. Binance co-founder Changpeng Zhao said on X that users should be careful with Ledger hardware wallets, particularly recently purchased ones, and suggested the reported thefts may result from a supply chain attack involving counterfeit or tampered devices. He added that, based on available information, the potential breach appeared to involve only one vendor and possibly a small number of customers.
Zhao also defended the manufacturer’s track record, calling Ledger one of the oldest and most secure hardware wallet makers. He said he hoped the crypto community, including the BNB ecosystem, could help track down the stolen funds and potentially recover them.
Where the reports diverge
The two accounts do not fully align on the size of the suspected theft. U.today cited Specter’s estimate of losses surpassing $86 million, while AMBCrypto cited Arkham’s figure of more than $80 million. Neither Ledger nor Arkham has confirmed how the losses occurred, and Ledger has not confirmed whether all the incidents relate to this particular reseller. Because tracked funds may already have moved out of the labelled addresses and crypto prices fluctuate, the visible balances are not the total suspected loss.
On the mechanism, both reports stop short of a conclusion. U.today said it remains unclear what caused the alleged thefts or whether any hardware was compromised. AMBCrypto said Ledger did not identify the affected device models or confirm that any Ledger product had been altered.
One thread connecting the case to past incidents involves geography. Former Mt. Gox chief executive Mark Karpelès weighed in on the situation, according to U.today, noting that CryptoBilis is based in Malaysia — the same country from which he said he allegedly received a tampered Ledger device. It is not clear whether the two episodes are linked.
Why it matters
Hardware wallets are marketed on the premise that private keys never leave the device, so any suggestion of tampered units strikes directly at the buyer’s threat model. The affected group here is narrow — people who purchased through a single authorized reseller in Southeast Asia — but the implications extend to how third-party distribution is audited. For holders, the practical distinction is between a compromised device (a supply chain failure) and a compromised recovery phrase (an operational one), and Ledger’s guidance addresses both: don’t initialize an unopened device, or migrate to a new wallet with a fresh seed phrase.
The episode also adds pressure to a well-worn industry debate about whether users should buy hardware wallets only from manufacturers rather than resellers, where sealed packaging offers the main line of defense against tampering.
What to watch
Ledger has promised to keep the community updated and has directed affected users to its official support channels. The next developments to track are whether Ledger confirms or revises the loss figure, whether the affected device models are identified, and whether on-chain tracking produces recoveries of the funds labelled by Arkham.
Frequently Asked Questions
What should I do if I bought a Ledger wallet from CryptoBilis in the last 90 days?
Ledger has advised customers who bought from the reseller within the past 90 days not to initialize their devices if they have not already done so. Those already using an affected wallet should consider moving their assets to a new Ledger device with a fresh recovery phrase.
Has Ledger confirmed how much crypto was stolen?
No. Ledger has not confirmed either the reported loss figure or whether all the incidents relate to this one reseller. Arkham estimated more than $80 million across Bitcoin, Ethereum and Tron, while blockchain investigator Specter put potential losses above $86 million.
Was Ledger’s own systems hacked?
There has been no confirmation of a company-wide Ledger exploit. Binance co-founder Changpeng Zhao suggested the reported thefts may stem from a supply chain attack involving counterfeit or tampered hardware wallets, possibly tied to a single vendor.
How many wallets are linked to the reported losses?
Arkham created a “ledger-drainer” label covering 152 addresses and said the labelled wallets held about $71.6 million at the time of writing. Specter said hundreds of crypto wallets on Bitcoin, Ethereum and Tron may have been affected.
