Ledger says every confirmed case in a suspected multimillion-dollar drain of its hardware wallets involves devices sold through a single Southeast Asian reseller, CryptoBilis.
The company began investigating on Friday after users who had bought devices from CryptoBilis reported losing funds. In a 72-hour update on Sunday, Ledger said “the volume of impacted devices is limited,” and that its own systems and direct sales channels were not affected. Ledger says CryptoBilis has confirmed it has stopped all hardware wallet sales.
How much was taken
On-chain investigator Specter has traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. Ledger has not confirmed that figure, and has not said what caused the losses.
On-chain analyst YFarmX says it has sent Ledger a list of more than 450 drained wallets. That figure has not been independently verified.
Some of the money has been stopped. Tether froze 10 million USDT on the first day. But much of the rest has moved through privacy tools, including about 2,810 ETH through Tornado Cash, and about 15,475 ETH, 203 BTC and 10 million USDD remain out of reach, according to YFarmX.
Reports from Europe
A separate claim is spreading. A user on X says he bought two Ledger devices from retail stores in Europe and found “identical modifications (such as additional cables and an LTE module).” He is sending one to Ledger for analysis and has called for a recall. No Ledger comment on those reports had been published at the time of writing, and they are unverified.
What to do
Ledger’s advice is direct. Do not set up any unused device bought from an unofficial seller. If you already use one, move your funds to a new seed phrase on a device bought directly from Ledger. Buy only from authorised sellers.
Ledger also warned that scammers may try to exploit the incident. It will never call you, message you or ask for your 24-word recovery phrase.
The company says it is reviewing reseller controls, strengthening hardware protections and working with the authorities. It has told its authorised resellers to source products only through official channels and never to restock returned products.
