Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis

Ledger said all confirmed cases in last week's draining incident involve devices sold through reseller CryptoBilis, and that its own systems and direct sales channels remain unaffected, in a 72-hour update on Sunday.

"The volume of impacted devices is limited," the Paris-based hardware wallet manufacturer said, adding that it is working with relevant authorities and reaching out to affected users. It said CryptoBilis has confirmed it has ceased all sales of hardware wallets.

Ledger began investigating on Friday after users in Southeast Asia who bought devices from CryptoBilis reported losing funds. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. Ledger has not confirmed that figure or said what caused the losses.

Onchain investigators YFarmX said they had sent Ledger a list of more than 450 drained wallets. According to their analysis, the thief pushed 2,810 ETH through coin mixer Tornado Cash in three runs, moved the withdrawals through Zcash's shielded pool, and withdrew about 3.28 million USDC into three fresh wallets, which Circle could freeze.

The thief also converted 15 million of the stolen USDT into USDD, a stablecoin Tether cannot freeze, before swapping 5.1 million back into USDT and sending about 4.23 million USDT to Binance deposit addresses, YFarmX said. Tether froze 10 million USDT on the first day, while 15,475 ETH, 203 BTC and 10 million USDD remain out of reach, according to the firm. Its findings have not been independently verified.

An X user, Johannes, has claimed to have found tampered Ledger devices in Europe, after buying two devices from retail stores. He said both had "identical modifications (such as additional cables and an LTE module)," and called on Ledger to issue a product recall.

The claims have not been independently verified, and Ledger's update said all confirmed cases so far involve CryptoBilis devices. He said he is sending the second device to Ledger for analysis. Decrypt has reached out to Ledger for comment on the European reports.

Reseller controls

In its update, Ledger said it is reminding authorized resellers and distributors to source products only through authorized channels and "never to restock returned products."

It also warned users against buying from unauthorized resellers, where "the risk of buying suspicious, counterfeit or modified devices is important."

The company said it is reviewing reseller controls and advancing hardware protections, and called on others in the industry to work with it on supply-chain and anti-tamper practices.

Ledger repeated its advice that CryptoBilis buyers should not set up unused devices, and that anyone who already has should move their funds to a new seed phrase on a device bought from Ledger.

It also warned that scammers may try to exploit the incident, saying it "will never call you, DM you, or ask for your 24-word recovery phrase."