Ledger Pins $87M Drain on One Reseller, Says “Volume of Impacted Devices Is Limited” 🔍

Ledger said Sunday that every confirmed case in last week's suspected drain has been tied to devices bought through a single reseller, CryptoBilis, and that its own systems and direct sales channels remain unaffected. In a 72-hour update, the Paris-based hardware wallet maker called the volume of affected devices "limited," added that it is working with relevant authorities, and said it is reaching out to impacted users. CryptoBilis has confirmed it has ceased all sales of Ledger hardware wallets.

The investigation began Friday after users in Southeast Asia who purchased devices from CryptoBilis reported losing funds. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum ($ETH), Tron and Bitcoin ($BTC). Ledger has not confirmed that figure or identified a cause. A second onchain investigator, YFarmX, said it has forwarded Ledger a list of more than 450 drained wallets. According to YFarmX, the thief pushed 2,810 ETH through coin mixer Tornado Cash in three runs, moved the withdrawals through Zcash's shielded pool and withdrew about 3.28 million USDC into three fresh wallets, which issuer Circle could potentially freeze.

YFarmX also said the attacker converted 15 million of the stolen USDT into USDD, a stablecoin Tether cannot freeze, before swapping 5.1 million back into USDT and routing roughly 4.23 million USDT to Binance deposit addresses. Tether froze 10 million USDT on the first day, YFarmX added, while 15,475 ETH, 203 BTC and 10 million USDD remain out of reach. Those figures have not been independently verified.

Separately, an X user named Johannes claimed to have found tampered Ledger devices in Europe after purchasing two units at retail stores, saying both showed "identical modifications (such as additional cables and an LTE module)" and calling for a product recall. The claims have not been independently verified, and Ledger's update limited its confirmation to CryptoBilis-sold devices. Johannes said he is sending one of the devices to Ledger for analysis, and Decrypt has requested comment from Ledger on the European reports.

Ledger said it is asking some customers to hold off on setting up their hardware wallets as a precaution and reminded authorized resellers and distributors to source products only through approved channels. The company has not commented further on the European report beyond its 72-hour update.