Ledger probes reported $80 million crypto theft linked to reseller

Key takeaways
Ledger has opened an investigation into customer losses reported in Southeast Asia after hardware wallets were purchased from CryptoBilis, an authorized reseller based in Malaysia. U.today said the French company confirmed the probe on Friday and asked the reseller to stop selling and shipping its devices until the review ends. Customers who bought from CryptoBilis in the past 90 days were warned not to initialize their wallets if they had not already done so.

The reported theft size remains unconfirmed. AMBCrypto cited blockchain analytics firm Arkham, which put suspected losses at more than $80 million across Bitcoin, Ethereum and Tron. U.today cited blockchain investigator Specter, which estimated losses above $86 million and said hundreds of wallets on those networks may have been affected. Ledger has not confirmed either figure, and neither Ledger nor Arkham has confirmed how the losses occurred.

What happened
The case centers on the distribution channel rather than a confirmed breach of Ledger’s company systems. Ledger did not identify affected device models or confirm that any Ledger product had been altered. Arkham created a “ledger-drainer” label covering 152 addresses. At the time of writing, those wallets held about $71.6 million, including roughly $29.4 million in Ether, $17.68 million in Bitcoin, $13.65 million in USDD and $10.85 million in USDT.

The visible balances are not the final loss estimate. Funds tracked by labels may have moved, and crypto prices change. The divergence between the $80 million and $86 million estimates shows how early on-chain analytics can be directional without establishing the exact amount stolen or the method.

Industry commentary widened the discussion. Binance co-founder Changpeng Zhao said on X that users should be careful with Ledger hardware wallets, particularly recently purchased ones. He suggested the reported thefts may result from a supply chain attack involving counterfeit or tampered devices. He also said the potential breach appeared to involve only one vendor and possibly a small number of customers, while calling Ledger one of the oldest and most secure hardware wallet makers. Zhao added that he hoped the crypto community, including the BNB ecosystem, could help track down the stolen funds and potentially recover them.

Former Mt. Gox chief executive Mark Karpelès added a geographic thread, noting that CryptoBilis is based in Malaysia, the same country from which he said he allegedly received a tampered Ledger device. The reports do not show that the two episodes are linked.

Market context
Hardware wallets are marketed on the premise that private keys never leave the device. That premise makes physical distribution part of the security model. Authorized resellers can make devices more accessible, but they also place a third party between the manufacturer and the user. The main defense against tampering is usually sealed packaging, which can be difficult to verify without independent testing.

The incident is narrow in one sense: the reported victims bought through a single reseller in Southeast Asia. It is significant in another: the suspected losses are large, the tracking is public, and the mechanism is unresolved. If the problem is a supply chain attack, it points to counterfeit or altered units. If it is an operational compromise, it points to setup or recovery phrase exposure. The two failures have different remedies.

Why it matters
For holders, the practical question is what to trust: the sealed box, the reseller, the device, or the initial setup process. Ledger’s guidance reflects both possibilities. It told recent CryptoBilis buyers not to initialize unopened devices. It also advised users already using an affected wallet to consider moving assets to a new Ledger device with a fresh recovery phrase. That is a standard way to isolate a suspected compromised seed phrase.

The episode also strengthens the industry debate over whether users should buy hardware wallets directly from manufacturers rather than through resellers. Direct purchase reduces one distribution risk, but it does not eliminate user-side errors, malware, phishing, or recovery phrase mistakes. The CryptoBilis case matters because it tests where the line sits between a trusted manufacturer, a trusted reseller, and a trusted user.

What to watch
Ledger has promised to keep the community updated and has directed affected users to its official support channels. The next signals will be whether the company confirms or revises the loss figure, whether it identifies affected device models, and whether it explains how the funds were moved. On-chain tracking may show whether the funds labelled by Arkham can be recovered or traced. Until those details are confirmed, the safest reading is that the case is a serious supply-chain and asset-recovery investigation, not a proven company-wide exploit.