Ledger Probes SEA Reseller Losses, Urges Users to Review Funds

Hardware wallet maker Ledger says it is investigating reports of cryptocurrency losses tied to devices sold by a Southeast Asian reseller, with the company urging recent buyers to stop using the affected units while the inquiry continues. In an update posted on X, Ledger asked reseller CryptoBilis to suspend further sales and shipments as a precaution, and warned customers who purchased within the past 90 days not to set up the devices.

Ledger also advised users who already initialized compromised-looking devices to transfer their assets to a new Ledger wallet created with a freshly generated recovery phrase. The company stated that its own infrastructure and services were not compromised, adding that its investigation is ongoing and it has not yet confirmed the cause or scope of the reported incidents.

Key takeaways

• Ledger is investigating alleged losses linked to devices purchased from CryptoBilis in Indonesia, Malaysia, and the Philippines.
• Customers who bought from the reseller within the last 90 days were told not to set up the devices.
• Users who already set up a device were advised to move funds to a new wallet and generate a new recovery phrase.
• Ledger says it has not received reports from customers who bought devices directly from the company, and it says its systems were not compromised.
• Separate on-chain investigations by multiple researchers have raised larger theft totals, but Ledger has not confirmed any direct connection beyond the reseller incident.

Ledger warns recent CryptoBilis buyers

Ledger’s statement, shared on X, instructs customers who purchased hardware wallets from CryptoBilis within the past 90 days to avoid initializing those devices. For anyone who already did, Ledger recommended transferring holdings to a newly generated Ledger wallet, using a signer created with a fresh recovery phrase.

Ledger said CryptoBilis is listed as an authorized reseller in Indonesia, Malaysia, and the Philippines. The company did not disclose how many customers may have been affected or how much value was lost, and it has not identified what caused the incidents or confirmed whether the devices were compromised.

Crucially, Ledger emphasized that it had not seen reports involving units bought directly from Ledger. The company added that its investigation is still underway and that it has not confirmed whether the alleged losses share a single root cause.

On-chain researchers cite large suspected thefts—without confirmed links

Alongside Ledger’s reseller-focused warning, on-chain researchers reported suspected cryptocurrency thefts involving wallets linked across multiple blockchains. Researcher tanuki42 identified eight wallet addresses allegedly associated with more than $72 million in losses. Fellow investigator Specter estimated that losses could exceed $86 million across Bitcoin, Ethereum, and Tron.

Ledger has not confirmed either figure, and the extent of any relationship between those wallet drains and Ledger devices purchased from CryptoBilis remains uncertain. The company said it appears the incident may be isolated to the reseller and the affected market, but it did not provide evidence tying the broader on-chain estimates directly to its hardware.

In response to a question about whether he had confirmed a connection, tanuki42 told Cointelegraph that he could not verify the link with certainty. However, he said he was “not aware of a victim report which does not involve this reseller” and that “there are enough victim reports now to be confident that this is not coincidence.”

Security group urges incident-response outreach

Security Alliance (SEAL) amplified tanuki42’s findings on X and urged anyone whose funds were transferred to the identified addresses to contact its incident-response team. SEAL did not offer an independent loss estimate or specify a cause for the suspected thefts.

That call highlights a key uncertainty investors and users should consider: while on-chain transfers can suggest movement patterns, without attribution from affected victims or device-level evidence, it can be difficult to determine whether the theft mechanism was tied to tampered hardware, compromised setup processes, or another factor entirely.

Flow of funds draws attention from Binance founder

On Friday afternoon, on-chain analytics account Onchain Lens reported that wallets allegedly linked to the suspected thefts transferred approximately $270,000 in USDT and TRX to Binance. The report said most of the funds were later forwarded to a Binance hot wallet.

Binance co-founder Changpeng Zhao commented on the situation, suggesting counterfeit or tampered Ledger devices may have been involved in what he described as a possible supply-chain attack. Zhao wrote on X that he expects industry participants to help trace and recover the funds.

Ledger has not publicly confirmed the broader theory of a supply-chain compromise. For users, the most actionable guidance remains Ledger’s device-level advice: stop using affected units and move assets to newly created wallets with fresh recovery phrases.

For now, the key open questions are whether Ledger will identify the specific compromise mechanism, whether the losses align precisely with devices purchased from CryptoBilis, and how far beyond the reseller the fallout may extend. Users who bought through the reseller should monitor Ledger’s updates closely, while anyone following the on-chain reports should watch for confirmations that translate wallet activity into verified device or victim case details.