Ledger is investigating cryptocurrency losses tied to devices sold by its Southeast Asian reseller CryptoBilis, telling customers who bought hardware wallets from the distributor in the past 90 days to treat them as potentially compromised. The hardware wallet maker posted the warning on X after receiving reports of missing funds, though it has not said how many users are involved or how much value has disappeared.
The reseller and the warning
CryptoBilis operates as an authorized Ledger reseller across Indonesia, Malaysia and the Philippines. Ledger asked the reseller to halt sales and shipments as a precaution. Buyers who have not yet initialized their devices were told not to do so. Anyone who has already set up a wallet sourced from CryptoBilis was advised to move assets to a new Ledger signer generated with a fresh recovery phrase.
Researchers put numbers on the losses
Onchain analysts published their own tallies before Ledger confirmed any figures. Researcher tanuki42 linked eight wallet addresses to more than $72 million in outflows. Fellow investigator Specter placed the total above $86 million spread across Bitcoin, Ethereum and Tron. Ledger has not validated either estimate, and the overlap with the CryptoBilis inquiry has not been established. Security Alliance amplified tanuki42's findings and asked victims to contact its incident-response team, though it offered no independent loss figure or root cause.
Ledger contains the blast radius
In a statement to Cointelegraph, Ledger said the issue appears confined to the reseller and its geographic market. The company said it has received no complaints tied to devices bought directly from its own channels. "Ledger's infrastructure, systems and services were not compromised," the company said, adding that the investigation remains open. No cause has been identified, and Ledger has not confirmed that any hardware was tampered with before reaching customers.
What happens next
The gap between researcher estimates and Ledger's silence on scale will persist until the company either confirms a figure or rules out a connection to the flagged addresses. For now, the advisory covers a 90-day purchase window at a single distributor. If the compromise turns out to be a supply-chain intervention rather than a user-error cluster, the recall logic shifts from a regional precaution to a broader trust test for the hardware wallet model itself.