Ledger pauses reseller sales amid suspected $72M-$87M wallet drains

Ledger said on October 9 that it is investigating reports of stolen funds from users in Southeast Asia who bought their devices through the reseller CryptoBilis, and has asked the reseller to halt all sales and shipments of Ledger products while the investigation runs.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis," the company's support account said in a post on X, adding: As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices."

What buyers are being told to do

Ledger advised customers who bought from the reseller within the past 90 days not to set up their devices. Those who already have should move their assets to a new Ledger device with a newly generated recovery phrase, the company said. The guidance is tied to where the device was bought, not where the buyer lives: CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines, and is based in Kuala Lumpur.

On-chain researchers began mapping the suspected thefts the same day. A pseudonymous researcher who posts as Specter traced inflows from hundreds of victim wallets across Ethereum, Tron and Bitcoin to a set of suspected theft addresses, putting total losses above $86 million. A second researcher, posting as tanuki42, listed eight of those addresses and put the figure above $72 million and rising. The two estimates may not cover the same addresses or transactions, and Ledger has confirmed no loss amount, no affected-customer count and no cause.

Based on information so far, it seems to be localized to a supply chain attack with one vendor," Binance co-founder Changpeng Zhao wrote on X. A small number of people probably bought fake (or tampered) Ledgers."

Ledger says its own systems were not hit

Ledger said its infrastructure, systems and services were not compromised, and that it has received no reports involving devices purchased directly from the company. The company describes the incident as isolated to the reseller and its market. Former Mt. Gox chief Mark Karpeles separately said the reports may match a tampered-device case he was already investigating, after he says he received a tampered device from Malaysia, and asked affected users to send him photos of their circuit boards.

The suspicion, unconfirmed as it is, lands on a channel the industry sells as the safe path. A hardware wallet only protects a user's keys if the device that arrives is the device the factory built: a tampered unit with a pre-generated recovery phrase hands the keys to whoever set it up. Ledger says it has sold more than 7 million devices worldwide, and CryptoBilis did not respond to press questions about the incident. The Security Alliance has asked anyone whose funds were drained to the suspected addresses to contact its SEAL 911 incident-response team.

The post Ledger pauses reseller sales amid suspected $72M-$87M wallet drains appeared first on Techreport.