Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses

Crypto hardware wallet maker Ledger said it is investigating reports of fund losses from users in Southeast Asia who bought its products from reseller CryptoBilis. One onchain researcher estimated the suspected thefts at more than $86 million.

The cause of the losses remains unclear. Ledger said it has asked CryptoBilis to pause all sales and shipments while it investigates. CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines.

"We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," Ledger's support account said in an X post on Friday. "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses."

The Block has reached out to Ledger for further comment.

Loss estimates remain unconfirmed

Onchain researcher tanuki42 said more than $72 million had moved to a group of suspected theft addresses. The researcher asked affected users to contact crypto security response group SEAL 911.

Another researcher, Specter, later estimated the losses at more than $86 million after tracing funds sent to addresses on Bitcoin, Ethereum and Tron.

Specter first said the funds came from hundreds of victim wallets. The researcher later clarified that the actual number of affected wallets was not yet known.

The figures have not been independently confirmed. It is also unclear whether the two estimates cover the same transactions and addresses.

Former Mt. Gox CEO Mark Karpeles said the reports could be linked to an issue he was already investigating. He asked affected users to contact him or open their Ledger devices and send pictures of the circuit board. Karpeles said the pictures could show whether the device had been tampered with.

Binance co-founder Changpeng "CZ" Zhao said available information suggested a supply chain attack involving one vendor. He said a small number of users may have bought fake or tampered Ledger devices.

"I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds," Zhao said, adding: "Self-custody comes with extra responsibilities."