Ledger is investigating reports that more than $86 million in cryptocurrency may have been stolen from hundreds of wallets associated with devices sold by CryptoBilis, a Southeast Asian reseller. The losses and the connection between the wallets have not been independently verified.
Pseudonymous blockchain investigator Specter said suspected theft addresses were traced across Bitcoin, Ethereum and Tron after Ledger users reported missing funds on X and Reddit. It remains unclear whether the incidents are connected or how much cryptocurrency was lost.
Ledger asked CryptoBilis to stop sales and shipments and advised recent buyers not to set up their devices. Customers who have already activated wallets were told to consider moving their assets to a new device with a newly generated recovery phrase.
A possible supply-chain attack could involve devices containing recovery phrases known to an attacker, who could later access funds deposited into the wallets. That scenario would differ from a breach of Ledger’s own systems, but there is no confirmation that tampering or pre-generated phrases caused the reported losses. Ledger said it would provide updates as the investigation continues.