Ledger has halted sales by its Southeast Asia reseller CryptoBilis after wallets belonging to customers who bought devices through that channel were drained of an estimated $72 million to nea
Ledger has halted sales by its Southeast Asia reseller CryptoBilis after wallets belonging to customers who bought devices through that channel were drained of an estimated $72 million to nearly $90 million.
The hardware wallet maker said it is investigating the losses and has asked CryptoBilis to pause all sales and shipments of Ledger devices pending the outcome. Ledger advised users who purchased from the reseller in the past 90 days not to set up unused devices, and to move assets to a new Ledger device with a new seed phrase if their device is already in use. It said it would keep customers informed as the investigation progresses.
On-chain estimates of the losses differ. The analyst Specter traced ten collection addresses and counted inflows from hundreds of victim wallets across Ethereum, TRON and Bitcoin, putting total losses above $86 million as the count was still rising. The analyst tanuki42 put the figure above $72 million, and MistTrack estimated almost $90 million. Ledger has confirmed no dollar amount.
CryptoBilis claims to be the authorized reseller of Ledger products in Malaysia and sells devices in Indonesia, Malaysia and the Philippines. It has not responded to a request for comment.
The suspected mechanism is supply-chain tampering rather than a flaw in Ledger’s software. Binance founder Changpeng Zhao said the available information points to a supply chain attack at a single vendor, with a small number of people likely having bought fake or tampered devices. Security researcher Taylor Monahan, for her part, insisted there is no zero-day in Ledger products and warned that hasty fund-moving exposes users to phishing risk greater than the incident itself.
Some stolen funds have already moved. On-chain tracking shows the suspected attacker has laundered about 430 ETH, worth roughly $1.07 million, through the mixer Tornado Cash, and Arkham-tracked wallets linked to the thefts still hold about $70.6 million. Tether has frozen USDT on addresses tied to the thefts, after which the attacker began swapping USDT into USDD, a Tron-based stablecoin Tether cannot freeze.
Ledger declined further comment. Its investigation is ongoing.
