Ledger, a leading hardware-wallet manufacturer, has opened an investigation after reports surfaced of substantial cryptocurrency losses linked to devices bought from a Southeast Asian reseller. The company warned customers who acquired a Ledger product from CryptoBilis in the last three months to avoid activating the wallet, and urged those who have already set it up to move assets to a newly generated device.
Scope of the issue
CryptoBilis operates as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger has not disclosed the number of customers potentially impacted nor the monetary value involved. The firm also clarified that its internal systems and services remain secure and that no incidents have been reported for devices purchased directly from Ledger.
On-chain loss estimates
Independent blockchain analysts have traced a series of suspicious transactions. One researcher, known as tanuki42, identified eight addresses that appear to be linked to more than $72 million in stolen funds. Another analyst, Specter, placed the total loss figure above $86 million, covering Bitcoin, Ethereum and Tron assets. The exact connection between these drains and the reseller’s devices has not been confirmed, though the pattern of victim reports points strongly toward the reseller’s market.
Movement of stolen assets
Further tracking by the analytics account Onchain Lens showed that roughly $270,000 worth of USDT and TRX were sent to Binance shortly after the alleged thefts. The majority of those tokens were quickly forwarded to a Binance hot wallet, suggesting rapid consolidation of the illicit proceeds.
Industry reaction
Binance co-founder Changpeng Zhao commented on the situation, suggesting the possibility of counterfeit or tampered Ledger units being used in a supply-chain attack. Zhao called on participants across the Binance ecosystem and the broader crypto industry to assist in tracing and recovering the displaced assets.
Ledger’s ongoing response
Ledger has instructed CryptoBilis to suspend all sales and shipments of its hardware wallets while the probe continues. Affected users are being advised to generate a fresh recovery phrase on a new device and transfer their holdings accordingly. The company emphasized that the investigation remains active and that it has not identified a definitive cause for the reported losses.
Why it matters
The incident underscores the vulnerability of hardware-wallet supply chains and highlights the importance of purchasing devices from trusted channels. As on-chain analytics become more sophisticated, they enable quicker detection of large-scale thefts, but the episode also reveals how quickly stolen funds can be moved across exchanges. Ongoing collaboration between manufacturers, researchers and exchanges will be crucial to mitigate future risks and protect user assets.
