Hardware wallet maker Ledger said Friday it is investigating reports of stolen funds linked to devices sold through CryptoBilis, a reseller in Southeast Asia, following claims that more than $86 million in cryptocurrency may have been stolen from hundreds of wallets.
Pseudonymous blockchain investigator Specter said on X that they traced suspected theft addresses across Bitcoin, Ethereum and Tron after seeing reports from Ledger users on X and Reddit. There has been no independent confirmation of the amount of user assets affected, and it remains unclear whether the incidents are connected or what caused the losses.
Ledger acknowledged the reports of missing funds from customers who purchased devices through CryptoBilis but did not confirm the reported loss amount or identify a cause. As a precaution, the company said it asked CryptoBilis to pause all sales and shipments while its investigation continues.
- Customers who purchased devices from the reseller within the past 90 days are advised not to begin setting them up.
- Those who have already activated their wallets should consider moving their assets to a new Ledger device with a newly generated recovery phrase.
One possible explanation under consideration is a supply-chain attack, in which hardware wallets are tampered with before reaching customers — for example, by supplying a device with a recovery phrase already known to an attacker, allowing later access to deposited funds. Such a scenario would differ from a breach of Ledger's own systems. There is no confirmation that device tampering or pre-generated recovery phrases caused the reported losses.
