Ledger Reseller Crypto Theft: Investigation into Southeast Asian Vendor

Ledger announced on X that it had asked the Southeast Asian reseller CryptoBilis to suspend sales and shipments of its hardware wallets as a precaution. The company warned customers who purchased devices from CryptoBilis in the last 90 days not to set them up, and urged those who had already activated a device to transfer their funds to a new Ledger signer with a freshly generated recovery phrase.

CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger has not disclosed how many customers may be impacted or the total value of the reported losses. The company also has not confirmed whether the devices were compromised or identified a root cause.

On-chain investigators tanuki42 and Specter identified wallet addresses that allegedly received more than $72 million and $86 million, respectively, across Bitcoin, Ethereum and Tron. Ledger has not verified these estimates, and the link between the addresses and the CryptoBilis incident remains unclear.

Ledger stated that its infrastructure, systems and services were not compromised and that the incident appeared isolated to the reseller and its market. The investigation is ongoing, and Ledger has not released further details.

Customers who bought a Ledger device from CryptoBilis in the last 90 days should avoid activating the device. If a device has already been set up, users should transfer all assets to a new Ledger wallet with a new recovery phrase. Ledger’s support team can provide guidance on the transfer process.

Ledger has not reported any incidents involving devices purchased directly from the company. The company’s statement suggests that the problem is confined to the reseller channel, but the absence of a confirmed cause means users should remain vigilant.

The estimated thefts of up to $86 million could influence sentiment around hardware wallet security, especially in Southeast Asia. Traders and holders may reassess the risk of using third-party resellers.

Ledger is continuing its investigation into the CryptoBilis incident. The company will likely release further details once it has confirmed the cause and scope of the losses.

Ledger’s support page and the X post linked to the investigation provide the latest updates. Users should monitor Ledger’s official channels for any new guidance.

The incident echoes other high-profile hardware wallet breaches, underscoring the importance of verifying reseller credentials and monitoring device firmware integrity. It also highlights the growing sophistication of on-chain theft operations that target specific wallet addresses.

Regulators may examine the oversight of authorized resellers and the transparency of hardware wallet supply chains. The case could prompt tighter controls on reseller licensing and device distribution.

Ledger’s situation follows a pattern of hardware wallet compromises that have surfaced in the past year, including the recent AI Wallet Attack: Bitcoin and Ether Holders Urged to Enter Bunker Mode.