Ledger Probes Wallet Drains Tied to Southeast Asian Reseller as Loss Estimates Top $86 Million

Ledger, the hardware-wallet maker, is investigating a wave of wallet drains among customers in Southeast Asia who bought its devices from a single reseller, CryptoBilis. The company has not confirmed a cause or a loss figure. Independent onchain researchers have put suspected losses between $72 million and more than $86 million. The episode matters less for its size than for the question it forces: what, exactly, a hardware wallet protects against.

What Ledger has said

On Friday, October 9, Ledger's support account said the company was investigating reports of fund losses among users who bought from CryptoBilis, according to The Block. Ledger said it had "asked CryptoBilis to pause all sales and shipments of Ledger devices" as a precaution, a quote carried by Finance Magnates. The wording matters: Ledger asked the reseller to stop, and has not said the reseller did anything wrong. The Block reports that CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines, and notes that its reporting does not say CryptoBilis caused the losses.

Ledger's guidance was narrow. Buyers who purchased from the reseller in the last 90 days and have not yet set up a device should not start setup. Those who have already set up a device should consider moving assets to a new Ledger signer with a new seed phrase, as Crypto Briefing reports. Finance Magnates stresses that Ledger did not tell all users to sweep their balances; the advice applies to the affected sales channel.

That distinction is the practical core of the story. Replacing both device and seed phrase is the remedy for a compromise that happened before the owner took control: a device altered in transit, or a recovery phrase someone else already knew. It is not the usual remedy for a flaw in firmware, which would call for a patch. Ledger's advice therefore points toward the distribution channel, though the company has not said so and has not tied the incident to any vulnerability affecting its devices generally.

What is known about the losses

The figures come from third parties, not Ledger. The Block reports that onchain researcher tanuki42 said more than $72 million had moved to a group of suspected theft addresses. A researcher using the name Specter later put the total above $86 million after tracing funds across Bitcoin, Ethereum and Tron. Specter first described hundreds of victim wallets, then clarified that the number of affected wallets is not yet known.

Neither estimate has been independently confirmed, and it is unclear whether they cover the same transactions. Finance Magnates adds that the estimate does not prove every drained wallet belonged to a CryptoBilis customer.

Two public figures commented. According to The Block, Mark Karpeles, the former chief executive of Mt. Gox, said the reports might be connected to an issue he had already been investigating, and asked affected users to send photographs of their device circuit boards, which could show signs of tampering. Changpeng Zhao, the Binance co-founder, said the available information pointed to a supply-chain attack involving one vendor, and that a small number of users may have bought fake or tampered devices. Both remarks were offered while facts were still emerging; neither is a finding.

The open question: where was control lost?

Finance Magnates frames the unresolved issue well. A hardware wallet keeps private keys inside the device after a secure setup, so funds can be taken only if the device, or the recovery phrase, was compromised somewhere before or during that setup. The publication lists candidate explanations without choosing among them: buyers may have received altered or counterfeit hardware, may have used recovery phrases that were already exposed, or may have lost funds through phishing or malicious transaction approvals. Its conclusion is that the incident cannot yet be described as a confirmed hardware-wallet exploit or a confirmed supply-chain attack.

The reports came less than three weeks after Bitget confirmed a $387.5 million breach of part of its hot and warm wallet infrastructure, Finance Magnates notes. There the exchange controlled the compromised wallets. In the Ledger case users hold their own keys, so the relevant failure, if there was one, lies in who controlled those keys before the buyer did. That shifts attention from cryptography to logistics: packaging, device checks at first use, and the trust placed in authorised resellers.

Why it matters

Self-custody is sold on the premise that holding keys on a dedicated device removes counterparty risk. An incident that turns out to involve tampering in the retail chain would not break that premise, but it would show that the risk has moved from the exchange to the supply chain, where individual buyers are poorly placed to verify anything. Zhao's comment that self-custody comes with extra responsibilities captures the tension: those responsibilities may now include checking where a device came from.

For Ledger, the near-term test is disclosure. Customers need a confirmed loss figure, a count of affected users, a clear statement of whether hardware was altered, and a timeline for resolving the reseller question. The Block reported no response from Ledger to its request for further comment. Ledger has not disclosed how many customers fall inside the 90-day window it described.

For exchanges and investigators, tracing is a collaborative exercise. Zhao said he expected and knew that BNB ecosystem players, and the wider industry, would help trace and recover the funds, a statement of intent rather than a commitment.

What to watch

Several facts would settle the story. First, whether Ledger or an independent party confirms that devices were physically altered or counterfeit, which would make this a supply-chain case, or finds that victims used already-exposed seed phrases, which would point elsewhere. Second, whether CryptoBilis explains its sourcing and inventory. Third, whether the loss estimate converges on a single figure once researchers agree on which addresses belong to victims. Fourth, whether Ledger widens its guidance beyond the channel it has named.

Until then, the reasonable reading is the narrow one: a serious, unexplained cluster of losses tied by timing and sales channel to one reseller, with a company response that treats the purchase channel as the likely point of failure without saying so.