Ledger has initiated an investigation into reported cryptocurrency losses involving hardware wallets purchased from CryptoBilis, an authorized reseller operating in Indonesia, Malaysia, and the Philippines. The company advised customers who bought devices from this reseller within the past 90 days not to set them up, while those already using them were urged to transfer assets to new signers with freshly generated recovery phrases. As a precautionary measure, Ledger requested that CryptoBilis suspend sales and shipments of its devices. The firm stated that the incident appears isolated to this specific reseller and market, noting no reports of issues with devices purchased directly from Ledger. Additionally, Ledger confirmed that its own infrastructure, systems, and services were not compromised.
The scope of the financial impact remains unconfirmed by Ledger, which has not disclosed the number of affected customers or the total value of losses. However, onchain researchers have identified suspected thefts across multiple blockchains. Researcher tanuki42 linked eight wallet addresses to over $72 million in losses, while investigator Specter estimated damages exceeding $86 million across Bitcoin, Ethereum, and Tron networks. Ledger has not validated these figures or established a definitive connection between the research findings and the CryptoBilis investigation. Security Alliance (SEAL) amplified the initial findings, urging victims to contact their incident-response team, though SEAL did not provide independent loss estimates or identify a cause for the thefts.
This incident highlights the operational risks inherent in third-party distribution channels for security-critical hardware. While Ledger’s statement that its core infrastructure remains uncompromised protects the brand’s technical credibility, the reliance on regional resellers introduces supply chain vulnerabilities that are difficult to monitor centrally. The discrepancy between Ledger’s silence on specific loss amounts and the substantial figures cited by independent researchers creates an information vacuum, potentially exacerbating user anxiety and complicating regulatory responses in the affected jurisdictions of Indonesia, Malaysia, and the Philippines.
Market structure implications suggest a growing tension between institutional adoption requirements and retail-facing supply chain integrity. If the losses are confirmed to stem from tampered devices rather than user error, it may trigger stricter compliance mandates for hardware wallet manufacturers regarding vendor audits and device authentication protocols. Stakeholders should watch for further forensic details that clarify whether the compromise occurred at the manufacturing, shipping, or point-of-sale stage, as this will determine the necessary remediation steps for both the reseller network and broader industry standards.
