Key Takeaways
- • Ledger has asked Malaysian reseller CryptoBilis to pause all sales and shipments of Ledger hardware wallets while it investigates reports that buyers lost funds.
- • On-chain investigator Specter estimates losses above $86 million across Bitcoin, Ethereum and TRON wallets; Ledger has not confirmed this figure.
- • Ledger told anyone who bought from CryptoBilis in the past 90 days not to set up the device, and advised existing users to move funds to a new device with a new seed phrase.
- • Ledger has not stated whether any devices were tampered with, nor explained how funds left user wallets.
- • A separate tracker-reported figure from Bitquery puts losses at $92.9M across 311 wallets on five chains, a discrepancy that remains unresolved in available reporting.
Summary
Ledger, the hardware wallet manufacturer, has asked Malaysian reseller CryptoBilis to halt all sales and shipments of its devices while it investigates reports that buyers lost cryptocurrency. According to Ledger Support, the precautionary pause applies pending the results of the investigation. The Malaysia-based shop, founded in 2020, sells crypto merchandise and Ledger devices and also operates in Indonesia and the Philippines. The warning covers only buyers from this reseller over the past 90 days.
The loss estimate originates with Specter, an on-chain investigator, who said funds were traced from hundreds of victim wallets on Ethereum, TRON and Bitcoin, with total losses above $86 million. Public mempool records show three Bitcoin addresses cited by Specter holding about 211 BTC combined, with no movement as of 13:44 UTC on the reporting day. Ledger has not endorsed the total. Other outlets cited in the coverage put the figure at more than $80 million or at $92.9 million across 311 wallets, per a Bitquery analysis, though these figures are not corroborated by Ledger.
Ledger has advised recent buyers not to set up devices purchased from CryptoBilis, and users who had already set up devices were told to transfer funds to a new device generated with a new seed phrase. The company has not confirmed whether devices were tampered with before reaching buyers, and it has not explained the mechanism by which funds were removed. Tampered hardware sold outside official channels is a documented risk; in April, a researcher reported counterfeit Ledger units on a Chinese marketplace that transmitted PINs and seed phrases to attackers. Separately, a firmware bug in rival hardware wallet Coldcard cost Bitcoin holders about $70 million in August. Ledger has said it will provide updates as the investigation progresses.
The loss estimate originates with Specter, an on-chain investigator, who said funds were traced from hundreds of victim wallets on Ethereum, TRON and Bitcoin, with total losses above $86 million. Public mempool records show three Bitcoin addresses cited by Specter holding about 211 BTC combined, with no movement as of 13:44 UTC on the reporting day. Ledger has not endorsed the total. Other outlets cited in the coverage put the figure at more than $80 million or at $92.9 million across 311 wallets, per a Bitquery analysis, though these figures are not corroborated by Ledger.
Ledger has advised recent buyers not to set up devices purchased from CryptoBilis, and users who had already set up devices were told to transfer funds to a new device generated with a new seed phrase. The company has not confirmed whether devices were tampered with before reaching buyers, and it has not explained the mechanism by which funds were removed. Tampered hardware sold outside official channels is a documented risk; in April, a researcher reported counterfeit Ledger units on a Chinese marketplace that transmitted PINs and seed phrases to attackers. Separately, a firmware bug in rival hardware wallet Coldcard cost Bitcoin holders about $70 million in August. Ledger has said it will provide updates as the investigation progresses.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.