Key Takeaways
- Hardware wallet manufacturer Ledger confirmed that all verified cases in a recent draining incident involve devices sold through reseller CryptoBilis, Decrypt reported.
- Ledger stated that its internal systems and direct sales channels remain unaffected, while CryptoBilis has ceased selling hardware wallets.
- Onchain investigators traced tens of millions of dollars in suspected thefts across Ethereum, Tron, and Bitcoin, though Ledger has not confirmed the total loss amount.
Reseller Compromise Linked to Multi-Million-Dollar Loss
In a 72-hour update issued on Sunday, Paris-based hardware wallet maker Ledger stated that all confirmed cases in a suspected $87 million draining incident involve devices sold through reseller CryptoBilis, Decrypt reported. Ledger launched its investigation on Friday after users in Southeast Asia who purchased devices from CryptoBilis reported losing funds. Ledger confirmed that CryptoBilis has ceased all sales of hardware wallets and stated that "the volume of impacted devices is limited."
Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin, though Ledger has not confirmed that figure or disclosed the precise cause of the losses. Onchain analytics firm YFarmX reported providing Ledger with a list of more than 450 drained wallets. YFarmX noted that the perpetrator routed 2,810 ETH through coin mixer Tornado Cash, moved funds through Zcash's shielded pool, and transferred stablecoins across multiple venues. Tether froze 10 million USDT on the first day of the incident, while 15,475 ETH, 203 BTC, and 10 million USDD remain out of reach, according to YFarmX.
Separately, an X user claimed to have found tampered devices with additional cables and an LTE module in retail stores in Europe. Decrypt noted these reports have not been independently verified, and Ledger reiterated that all confirmed cases so far are tied strictly to CryptoBilis devices.
Why It Matters
The incident underscores secondary supply-chain vulnerabilities for hardware wallet providers, demonstrating that third-party reseller channels can introduce security risks even when a manufacturer's core infrastructure remains uncompromised. In response, Ledger urged authorized distributors "never to restock returned products" and warned that purchasing from unauthorized resellers carries significant risks of counterfeit or modified devices.
What to Watch
Ledger advised customers who purchased devices from CryptoBilis not to set up unused units. Users who have already configured CryptoBilis devices are advised to transfer their funds immediately to a new seed phrase generated on a device bought directly from Ledger. Users should also remain cautious of potential phishing attempts, as Ledger emphasized that it will never call, direct-message, or ask for a user's 24-word recovery phrase.
