Urgent Warning: Ledger Users Report Losses From Reseller Wallets
Hardware wallet maker Ledger is investigating significant user fund losses in South East Asia linked to devices bought from reseller CryptoBilis, with over $86 million reportedly stolen. Ledger advises affected customers not to set up new devices or to transfer assets, while emphasizing its own systems remain secure. This incident comes amidst other recent security breaches within the broader crypto industry.
Hardware wallet manufacturer Ledger is currently investigating reports of significant user fund losses from customers in South East Asia who purchased devices from a reseller named CryptoBilis. The Paris-based company issued a warning on Friday, advising any customer who acquired a device from CryptoBilis within the last 90 days to refrain from setting it up. While Ledger has not disclosed the exact amount of funds lost, blockchain investigator Specter reported on X that over $86 million had been traced to theft addresses following social media posts about the incidents.
Ledger, via its support X account, confirmed the ongoing investigation into the loss of funds from users in South East Asia. In response, Ledger has instructed CryptoBilis to temporarily halt all sales and shipments of its devices. For users who have already set up their Ledger devices purchased from CryptoBilis, the company strongly recommends moving their assets to a new Ledger signer with a new seed. Ledger has committed to providing ongoing updates as the investigation progresses.
In a statement to Bitcoin Magazine, Ledger clarified that, based on current information, this incident appears to be isolated specifically to the reseller CryptoBilis in the South East Asian market. The company emphasized that no reports were made concerning products purchased directly from Ledger, and asserted that Ledger’s own infrastructure, systems, and services have not been compromised. CryptoBilis is identified as a Kuala Lumpur, Malaysia-based hardware wallet vendor.
This incident adds to a series of security challenges faced by the crypto industry this year. In July, hackers stole approximately $120 million in Bitcoin from users of Coldcard hardware wallets. The Coldcard devices, manufactured by Canadian company Coinkite, were found to have a firmware bug that led to faulty seed generation, which allowed attackers to guess investor seed phrases. Galaxy Research later indicated that multiple attackers independently exploited this bug.
Furthermore, last month, another hardware wallet manufacturer, Trezor, disclosed that the details of nearly 81,000 customers were leaked after a data breach at its third-party fulfillment partner. Scammers have also been actively targeting customer data throughout the year, notably obtaining customer information via Ledger’s payment processor, Global-e, to send out sophisticated phishing emails.