Ledger Says "Don't Plug It In" as $86M+ Drain Probe Points to One Southeast Asian Reseller

Hardware wallet maker Ledger said it is investigating reports that customers in Southeast Asia who purchased devices from a reseller called CryptoBilis (also written CryptoBillis) have lost funds, and has asked the reseller to pause all sales and shipments of Ledger devices pending results. In a post on X, the company's @Ledger_Support account said: "Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices." Ledger urged anyone who bought from the reseller in the past 90 days not to set up their device if they have not already done so, and recommended that users who have already set up a wallet consider moving their assets to a new Ledger signer with a new seed phrase, the master backup that can regenerate a wallet's private keys. CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.

Ledger has not disclosed how many customers may be affected, the value of the reported losses or a confirmed cause. In a statement to Cointelegraph, the Paris-based company said the incident appeared to be isolated to the reseller and affected market, adding that it had received no reports involving devices purchased directly from the company. "Ledger's infrastructure, systems and services were not compromised," the company said, noting its investigation is ongoing. Ledger provided no further detail on how the suspected compromise may have occurred.

Onchain researchers have circulated their own loss estimates. Pseudonymous investigator tanuki42 identified eight wallet addresses allegedly linked to more than $72 million in losses, while Specter (@SpecterAnalyst) wrote that they traced theft addresses flagged in user reports on X and Reddit and found inflows from more than 200 victim wallets across Ethereum ($ETH), TRON and Bitcoin ($BTC). "Total losses $86M+," Specter wrote. Arkham data shared by the investigator shows nearly $87 million at those addresses, including about $42 million in $ETH, $17.6 million in $BTC and $16.5 million in $USDT. Ledger has not confirmed either figure, and it is unclear whether every theft is linked to the reseller. Crypto security organization Security Alliance (SEAL) amplified tanuki42's findings on X and urged anyone whose funds were transferred to the identified addresses to contact its incident-response team; it did not provide an independent loss estimate.

The episode lands during a difficult period for crypto security. Rival hardware wallet maker Trezor disclosed a data breach in August affecting nearly 14,000 customers, and disclosed a separate breach of its email just last month. Bitget lost roughly $387 million in a hack investigators have tied to North Korea. Blockchain tracking firms Chainalysis and Elliptic have since traced part of that haul, and North Korean-linked actors also spent six months infiltrating Solana exchange Drift before a $285 million exploit, after which Drift laid out a plan to repay users. Most recently, self-described white hat hackers withdrew $320 million in $BTC from Blockstream's Liquid sidechain before negotiating with the company over the funds.