Ledger, the prominent hardware wallet manufacturer, is investigating reports of massive cryptocurrency fund drains affecting users who purchased devices through a Southeast Asian reseller, with onchain estimates placing losses at more than $86 million.
The company has asked reseller CryptoBilis to pause sales and has issued an urgent advisory for recent buyers not to set up their devices until further notice Decrypt. The warning comes as social media posts document assets disappearing from Bitcoin, Ethereum, and Tron addresses associated with wallets sourced through the distribution channel CoinDesk.
The investigation centers on users in Southeast Asia who bought Ledger products from CryptoBilis, according to statements from the company The Block. An onchain investigator has tracked suspected thefts totaling more than $86 million, though the exact mechanism of compromise remains under examination.
The scale of the reported losses—exceeding $86 million—represents one of the most significant hardware wallet security incidents in recent memory. Hardware wallets are generally considered among the most secure methods for storing cryptocurrency private keys offline, making widespread compromises particularly concerning for the industry.
Ledger's decision to publicly name CryptoBilis and request an immediate sales halt suggests the company suspects supply chain interference rather than a firmware or software vulnerability in its own products. Such tampering could involve device modification during distribution, compromised seed phrase generation, or other physical alterations that would expose users' funds.
The geographic concentration in Southeast Asia points to a targeted supply chain attack rather than a global product flaw. CryptoBilis operates as an authorized reseller in the region, meaning devices would have appeared legitimate to purchasers. This attack vector—exploiting trusted distribution relationships—has proven effective in previous cryptocurrency thefts.
Users who purchased Ledger devices through CryptoBilis recently are advised to refrain from initializing their wallets or transferring funds to them. The company has not yet provided guidance on how affected purchasers should verify device integrity or secure alternative storage for existing holdings.
The incident highlights persistent vulnerabilities in cryptocurrency hardware supply chains, where even security-focused products can be compromised between manufacturer and end user. As Ledger's investigation continues, the case may prompt broader industry examination of reseller verification protocols and physical security standards for hardware wallet distribution.