Ledger investigates $72–$86M in crypto losses linked to counterfeit or tampered hardware wallets from Southeast Asian reseller CryptoBilis.
Security & Exploits ·
Ledger is investigating reports of between $72 million and $86 million in cryptocurrency losses from users who purchased hardware wallets through CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, and the Philippines. The company's official support channel confirmed it is examining the incident and asked CryptoBilis to halt all sales and shipments. Users who obtained devices from the reseller within the past 90 days and have not yet completed setup are being advised against doing so; those already using such devices should consider moving assets to a new Ledger signer with a freshly generated seed phrase.
On-chain researchers traced differing estimates of the theft, with one investigator identifying over $72 million in suspected theft addresses and another estimating losses exceeding $86 million across Bitcoin, Ethereum, and Tron. The evidence points toward a localized supply-chain attack centered on one vendor, with speculation that devices may have been counterfeit or physically tampered with. Former Mt. Gox CEO Mark Karpeles reported examining modified Ledger devices containing hidden hardware implants capable of capturing recovery words, and he requested that CryptoBilis inspect units from its inventory for similar components.
Ledger maintains that its infrastructure, systems, and services have not been compromised and that reports appear limited to products sold through CryptoBilis. The exact mechanics of the attack remain unclear, as does whether the varying loss estimates overlap. Tether reportedly froze USDT in addresses linked to the incident, though the full scope of affected customers and the precise role of any tampering remain under investigation.