What changed

A hardware wallet is only as trustworthy as the chain of custody that gets it into a buyer’s hands, and Ledger is now investigating whether that chain broke somewhere between manufacturing and a reseller in Southeast Asia. The company has asked distributor CryptoBilis to halt all sales and shipments while it looks into reports of fund losses, and it’s telling anyone who bought from that reseller in the past 90 days to treat their device, and potentially their seed phrase, as compromised.

That’s a materially different posture than a typical phishing or malware warning. If a device or its recovery phrase was exposed before a customer ever opened the box, the usual safeguards of offline key storage don’t apply, no matter how carefully the owner behaved afterward.

Key Takeaways

  • Ledger asked reseller CryptoBilis, an authorized distributor in Indonesia, Malaysia and the Philippines, to pause all sales and shipments pending investigation.
  • Buyers from the past 90 days are told not to set up new devices, and those already set up should move funds to a new Ledger signer with a freshly generated seed.
  • Onchain researchers’ estimates diverge: tanuki42 traced over $72 million to suspected theft addresses, while Specter put the figure above $86 million across Bitcoin, Ethereum and Tron.
  • Ledger says its own infrastructure, systems and services were not compromised and that reports are isolated to the CryptoBilis channel.
  • The attack mechanism, whether tampered hardware, pre-exposed seed phrases or something else, has not been confirmed.

What Ledger is telling customers to do

Ledger’s support account posted the warning on X on Friday, directing it specifically at buyers who went through CryptoBilis. Anyone who purchased a device from that reseller in the last 90 days and hasn’t initiated setup yet was told to hold off entirely. Anyone who has already set up a device was advised to consider moving assets to a new Ledger signer, using a new seed, the master recovery phrase a wallet uses to regenerate its private keys.

Ledger has not said how many customers are affected or confirmed any loss figure. In a statement to Cointelegraph, the company said the incident “appeared to be isolated to the reseller and affected market,” adding that it had received no reports involving devices bought directly from Ledger and that “Ledger’s infrastructure, systems and services were not compromised.”

Why a reseller breach could bypass hardware wallet protections

A hardware wallet’s security model depends on the private key never leaving the device and never being known to anyone but the owner. That model fails if the compromise happens upstream, before the buyer ever touches the hardware. A device shipped with a recovery phrase an attacker already knows, or physically tampered with in transit, can leave funds exposed later regardless of how the owner subsequently stores it, as Decrypt and Finance Magnates both noted.

Binance co-founder Changpeng “CZ” Zhao said the available information points to a supply chain attack involving a single vendor, with a small number of users potentially having bought fake or tampered devices. Former Mt. Gox CEO Mark Karpeles said the reports could connect to an issue he was already investigating, and he’s asking affected users to open their devices and photograph the circuit board, which could show whether the hardware was altered. Neither tampering nor a specific attack vector has been confirmed.

Loss estimates diverge and remain unconfirmed

Two onchain researchers published separate, unverified tallies. Tanuki42 identified eight suspected theft addresses tied to more than $72 million in losses and pointed affected users toward crypto security response group SEAL 911. Specter traced inflows across Bitcoin, Ethereum and Tron to addresses holding more than $86 million, later clarifying that the actual number of affected wallets, initially described as “hundreds,” had not actually been established. Arkham data cited by Decrypt put the holdings at those addresses near $87 million, including roughly $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT.

It’s unclear whether the two estimates cover the same transactions or overlap at all, and neither has been independently confirmed. Tanuki42 told Cointelegraph he hasn’t confirmed the CryptoBilis link with certainty but said: “I’m not aware of a victim report which does not involve this reseller. There are enough victim reports now to be confident that this is not coincidence.”

Separately, onchain analytics account Onchain Lens reported that wallets linked to the suspected thefts moved roughly $270,000 in USDT and TRX to Binance, with most of it forwarded to a Binance hot wallet, according to Cointelegraph. Zhao said he expects “all BNB ecosystem players (and all industry) to help trace and recover the funds,” while adding that “self-custody comes with extra responsibilities.”

What to Watch

Ledger has said it will continue updating customers as the investigation progresses, but it has not given a timeline for confirming a cause, a victim count or a final loss figure. Whether tanuki42’s and Specter’s estimates converge, and whether Karpeles’ circuit board photos turn up evidence of physical tampering, are the next concrete signals to watch. Until then, the scope of the CryptoBilis-linked drains, and whether CryptoBilis’s distribution in Indonesia, Malaysia and the Philippines remains paused or resumes, stays an open question.

Sources