Ledger Probes $87 Million Crypto Theft Linked to Reseller

What Happened with Ledger and Crypto Bilis?

Crypto hardware wallet manufacturer Ledger is officially investigating a serious security concern. Several users in Southeast Asia reported losing their funds after purchasing hardware devices from an authorized third-party reseller named Crypto Bilis.

In response to these alarming reports, Ledger took swift action. The Paris-based wallet maker asked Crypto Bilis to immediately halt all sales and shipments of its products while an internal investigation takes place.

Think of a hardware wallet like a digital safe deposit box. It keeps your private keys completely offline, away from internet hackers. But if that safe is somehow compromised before it reaches your hands, your assets can be put at serious risk.

As a precaution, and pending the results of our investigation, we have asked Crypto Bilis to pause all sales and shipments of Ledger devices.

Crucial Steps for Recent Buyers

Ledger issued urgent instructions for customers who purchased a device from Crypto Bilis within the last 90 days. The advice depends on whether you have already unboxed and configured your device.

• If you bought a device in the last 90 days and have not set it up yet: Do not set it up. Leave the device unused until further instructions.
• If you have already set up your device and stored funds on it: Move your funds immediately to a clean, new device using a completely fresh seed phrase.

A seed phrase, or recovery phrase, acts as the master key to your crypto wallet. It is a series of words that generates your private keys. If an attacker knows your seed phrase beforehand, they can easily drain your funds remotely without needing physical access to your device.

Following the $87 Million On-Chain Money Trail

While Ledger has not officially confirmed the total financial loss or the root cause, on-chain researchers have begun piecing together the evidence. Pseudonymous crypto investigator Specter analyzed wallet drain incidents reported across platform networks like X and Reddit.

Specter traced theft addresses connected to hundreds of affected victim wallets across multiple major blockchain networks, including EthereumETH+2.21%, TronTRX-0.62%, and Bitcoin.

Total losses $86M+... I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin.

Data from blockchain analytics platform Arkham revealed even higher totals tied to those malicious wallet addresses, reaching nearly $87 million. The breakdown of identified stolen assets includes:

• Ethereum (ETH): Approximately $42 million
• Bitcoin (BTCBTC+1.80%): Approximately $17.6 million
• TetherUSDT-0.21%: Approximately $16.5 million
• Other digital tokens making up the remaining total balance

It remains unclear whether every single stolen dollar identified in these addresses is directly linked to the Crypto Bilis reseller incident. Ledger has emphasized that their official investigation is ongoing.

How Can a Hardware Wallet Be Compromised?

Hardware wallets are widely considered one of the safest methods for self-custody in crypto. They store key signatures inside specialized secure hardware chips, keeping them isolated from online malware.

However, security vulnerabilities can still occur through supply chain tamper points or social engineering tactics. For instance, malicious middlemen could pre-configure a device and slip a pre-printed recovery card inside the box.

If an unsuspecting buyer uses that pre-generated seed phrase instead of generating a brand-new one directly on the device screen, the attacker retains full access to all deposited assets. Ledger noted that physical tampering has not been confirmed in this specific case yet.

Security Troubles Across the Hardware Wallet Industry

Ledger is not the only hardware wallet provider confronting security headwinds. Competitor Trezor has also encountered its own operational challenges in recent times.

Trezor experienced a security breach involving a third-party shipping partner, which exposed sensitive customer data. Additionally, Trezor faced an unauthorized breach of its email system, illustrating how third-party vendors often represent vulnerable entry points.

A Challenging Climate for Crypto Security

This incident adds to a troubling wave of security breaches across the broader cryptocurrency sector. Industry tracking firms have reported several massive exploits in recent months.

Crypto exchange Bitget suffered a major loss of roughly $387 million in a cyberattack. Security analytics firms Chainalysis and Elliptic successfully traced portions of the stolen funds, tying the exploit to state-sponsored hackers from North Korea.

In another complex attack, North Korean hackers spent six months stealthily infiltrating the SolanaSOL+0.82%-based decentralized exchange Drift. That breach resulted in a $285 million exploit, after which Drift published a recovery plan to reimburse affected users.

In September, self-described white-hat hackers managed to withdraw $320 million worth of Bitcoin from Blockstream's Liquid sidechain, later entering formal negotiations with the company to safely return the assets.

Understanding Risk and Staying Protected

These security events coincide with ongoing fluctuations across digital asset markets. Bitcoin (BTC) recently traded in the $80,427 to $86,700 range, highlighting the high levels of activity across major blockchain networks.

While self-custody remains a powerful way to manage digital wealth, choosing reputable purchasing channels and verifying setup steps is crucial. Always generate your seed phrase directly on your hardware device during initial setup, and never share those words with anyone.

Past returns of digital assets or past performance do not guarantee future returns or performance. Cryptocurrency investments involve market risks and price volatility, so investors should always stay informed and exercise caution.