Ledger Probes Stolen Funds Linked to Reseller

Ledger Investigates Theft Reports Linked to Malaysian Reseller

Hardware wallets are widely regarded as one of the most reliable methods for securing digital assets. However, offline security can still face vulnerabilities if the physical distribution chain is compromised. Hardware wallet manufacturer Ledger has opened an official investigation after receiving reports of stolen funds linked to one of its authorized resellers in Southeast Asia.

The reseller at the center of the investigation is Crypto Bilis, an authorized seller based in Malaysia. To protect users, Ledger instructed Crypto Bilis to immediately pause all sales and shipments of devices while the team determines what happened.

Urgent Security Guidance for Affected Customers

Ledger issued an urgent warning to anyone who purchased a device from Crypto Bilis within the last 90 days. The guidance depends on whether the device has already been set up:

• Uninitialized devices: If you bought a wallet from Crypto Bilis in the past 90 days and have not turned it on or set it up yet, do not initialize it.
• Already initialized devices: If you are already using a device from this reseller, Ledger recommends moving your funds to a separate, secure hardware wallet generated with a completely new recovery phrase.

At this stage, Ledger has not confirmed the exact technical cause of the reported thefts or whether any device hardware was directly modified.

Industry Leaders Weigh In on Potential Supply Chain Risks

Binance co-founder Changpeng Zhao (CZ) commented on the situation on social media platform X. He suggested that the incident bears the signs of a supply chain attack, where devices might have been intercepted, tampered with, or replaced with modified units before reaching buyers.

Beware if you use a Ledger HW wallet. Especially if you got one recently.

CZ noted that based on available information, the vulnerability appears confined to a single vendor. This suggests only a limited number of customers may have received compromised units. He also defended Ledger's overall reputation, emphasizing that Ledger remains one of the oldest and most established hardware wallet manufacturers in the industry.

Former Mt. Gox CEO Mark Karpelès also shared insights regarding the news. Karpelès mentioned that he previously received a modified Ledger unit originating from Malaysia, raising broader questions about third-party reseller distribution networks. However, no direct connection has been established between Karpelès' past experience and the current investigation.

Scope of Potential Losses Under Review

Blockchain security researchers are currently analyzing on-chain movement to determine the scale of the incident. On-chain investigator Specter estimates that potential losses tied to the breach may exceed $86 million across hundreds of compromised addresses on BitcoinBTC+2.15%, EthereumETH+2.96%, and TronTRX-0.62% networks.

Ledger has not officially verified these loss figures or confirmed whether all reported instances stem from the same reseller. The company advised affected users to submit inquiries strictly through official Ledger support channels while the investigation remains active.

Best Practices for Hardware Wallet Security

While hardware wallets keep private keys offline, physical distribution remains an important factor in total security. Users can reduce potential supply chain risks by keeping the following precautions in mind:

• Purchase direct when possible: Buying directly from the official manufacturer minimizes middleman exposure.
• Verify device setup: A genuine hardware wallet will always generate a fresh seed phrase on-device during setup. Never use a device that comes with a pre-printed recovery sheet.
• Check official integrity tools: Most modern hardware wallets run automated cryptographical checks via their official software apps to verify genuine firmware before initialization.

While self-custody gives users complete control over their funds, digital assets remain volatile and subject to operational risks. Investors should stay informed and regularly review their personal security setup.