Ledger reseller investigation widens as theft estimates rise

Ledger is investigating suspected cryptocurrency thefts involving wallets sold through Southeast Asian reseller CryptoBilis, as blockchain investigators raise their estimated losses beyond $86 million.

The hardware wallet manufacturer has asked CryptoBilis to suspend sales and shipments while it examines complaints from customers whose digital assets disappeared. Ledger has not confirmed the total stolen, established how many people were affected or identified the cause of the reported losses.

Blockchain intelligence company Bitquery estimated losses at $93.2 million across 315 wallets in an analysis updated on 11 October, exceeding the earlier figure circulating among investigators. Its findings cover transactions across several blockchain networks, but the estimate remains an independent assessment rather than a verified tally accepted by Ledger.

The widening figures have intensified scrutiny of whether devices were compromised before reaching customers. Such a supply-chain attack could expose recovery phrases, the secret words that enable control of cryptocurrency holdings, without attackers needing to gain access to Ledger’s central systems.

Ledger said its information suggested that the affected devices were limited to those supplied through CryptoBilis in Southeast Asia. The company said it had no indication that its security infrastructure, systems or services had been compromised. That assessment does not establish precisely where any interference occurred.

The company warned customers who purchased devices from CryptoBilis during the preceding 90 days not to begin setting them up. Those who had already activated their wallets were advised to consider transferring assets to a new Ledger signing device using an entirely new recovery phrase.

The recommendation specifically concerns customers of the named reseller, rather than everyone who has purchased a Ledger wallet. Moving funds to another account derived from the same potentially exposed recovery phrase would not eliminate the suspected risk. An exchange account can carry separate custody and security risks, making a fresh, trusted wallet the more direct precaution.

Initial estimates emerged on 9 October when blockchain investigator tanuki42 identified more than $72 million flowing to addresses suspected of receiving stolen assets. Another investigator, operating under the name Specter, subsequently traced more than $86 million across Bitcoin, Ethereum and Tron networks.

Specter initially suggested that funds came from hundreds of victim wallets but subsequently clarified that the number of affected wallets had not been established. Investigators have also not demonstrated that every transaction included in their calculations originated from a CryptoBilis customer or represented a confirmed theft.

Bitquery’s wider assessment included activity beyond the networks examined in the first estimates. The company described a concentrated sequence of withdrawals and movements through intermediary addresses. Its tracing offers a fuller picture of potentially connected transactions, although blockchain records alone cannot determine who controlled every account or how access was obtained.

The company also identified movements of suspected stolen funds through cryptocurrency services, illustrating the obstacles investigators face once assets begin passing between addresses and networks. Transfers into privacy-focused tools or pooled exchange accounts can make subsequent identification and recovery more difficult.

The suspected transactions span different cryptocurrencies, whose values can change while investigators follow the money. That complicates comparisons between estimates produced at different times. Researchers must also distinguish original withdrawals from transfers between addresses controlled by the same person, otherwise the same assets can be counted more than once. Neither public transaction histories nor address clustering can independently prove a device was compromised.

Questions about physical tampering have attracted attention after former cryptocurrency exchange executive Mark Karpeles urged affected owners to inspect the circuit boards inside their devices. He suggested that photographs might help establish whether hardware had been altered. That possibility remains separate from a confirmed explanation for the broader losses.

If an unauthorised component intercepted recovery information during wallet setup, changing software settings or remotely updating the compromised device would not necessarily secure assets already controlled by an attacker. Establishing whether such modifications occurred, and how widely, requires examination of affected hardware and the reseller’s supply chain.

CryptoBilis has been listed among authorised Ledger resellers serving Indonesia, Malaysia and the Philippines. Authorised status does not by itself establish whether a particular unit remained secure throughout distribution, storage and delivery.

Ledger’s existing security guidance recommends checking device authenticity during initialisation and avoiding equipment showing signs of interference. It also advises customers never to disclose recovery phrases. The company has directed concerned CryptoBilis purchasers to its official support channels as the investigation continues.