Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis

Introduction

Ledger, the Paris‑based hardware‑wallet manufacturer, has issued a 72‑hour update confirming that every verified case of the recent multi‑billion‑dollar crypto drain originated from devices sold by the Southeast Asian reseller CryptoBilis. Ledger stresses that its own production lines, direct‑to‑consumer channels, and authorized distributors remain secure, and it is working with law‑enforcement agencies to investigate the incident.

What happened?

• Scope of the loss: On‑chain analysts have traced more than $86 million in stolen assets across Bitcoin, Ethereum, Tron and several stablecoins. While Ledger has not independently verified the total figure, the pattern points to a coordinated theft involving large‑scale transfers through mixers and shielded pools.
• Reseller link: All confirmed compromised wallets were linked to hardware purchased from CryptoBilis. The reseller has now halted all hardware‑wallet sales and is cooperating with authorities.
• Device tampering claims: A user on X reported finding modified Ledger units in European retail stores, describing added cables and an LTE module. Ledger has not verified these claims and notes that, to date, only CryptoBilis‑origin devices are implicated.

Ledger’s response

1. Supply‑chain tightening – Ledger reminded authorized partners to source products exclusively through official channels and to avoid restocking returned units. The company is reviewing its reseller controls and exploring additional anti‑tamper hardware measures.
2. User guidance – Customers who bought a wallet from CryptoBilis are advised not to initialize the device. Those who have already set it up should immediately transfer assets to a new seed phrase generated on a genuine Ledger device purchased from an authorized seller.
3. Scam awareness – Ledger warned that scammers may exploit the situation, reiterating that the company will never contact users directly to request their 24‑word recovery phrase.
4. Collaboration with investigators – Ledger is sharing information with on‑chain investigators and law‑enforcement bodies, while also supporting independent forensic analysis of the alleged tampered units.

Practical steps for affected users

• Check the purchase source: Verify whether your device was bought from CryptoBilis or any other unauthorized reseller.
• Do not reuse the seed phrase: Generate a fresh recovery phrase on a verified Ledger device before moving any funds.
• Monitor your addresses: Use block‑explorers to watch for any unexpected activity on wallets associated with the compromised devices.
• Report suspicious activity: Contact Ledger support and local authorities if you suspect your wallet has been tampered with or funds have been drained.

Closing thoughts

While the incident underscores the risks inherent in a fragmented hardware‑wallet supply chain, Ledger’s swift clarification and concrete remediation steps aim to contain the damage and restore confidence. Users should remain vigilant, source devices only from authorized channels, and treat any unsolicited contact requesting private keys as a clear phishing attempt.