Ledger investigates reported fund losses tied to reseller CryptoBilis as estimates top $86 million
Ledger is investigating reports of drained wallets among Southeast Asian customers who purchased devices from reseller CryptoBilis, with on-chain analysts estimating total losses at more than $86 million across multiple blockchains.
Hardware wallet maker Ledger has launched an investigation into reports of lost customer funds in Southeast Asia linked to authorized reseller CryptoBilis, also referred to as CryptoBillis. As a precaution pending the outcome of the inquiry, Ledger requested that the reseller pause all device sales and shipments.[1][3][7][8]
While Ledger did not confirm a total loss figure, on-chain analysts reported extensive thefts across Bitcoin, Ethereum, and Tron. On-chain investigator Specter tracked more than $86 million drained from hundreds of victims' wallets into designated theft addresses. Arkham Intelligence data identified an entity labeled 'ledger user theft' holding $86,964,156 across 98 addresses, mostly in ether, bitcoin, USDT, and USDD. Separately, Lookonchain estimated total losses nearing $90 million, highlighting a single victim who had 7 million USDT stolen three weeks after buying a device from the reseller.[1][2][6][9]
Ledger advised customers who purchased hardware from the reseller in the past 90 days not to initiate setup on those devices. For users who have already set them up, the company recommended moving assets to a fresh Ledger signer with a newly generated seed phrase. Security researcher tanuki42 and the Security Alliance urged victims who lost funds to reach out to SEAL 911 on Telegram. There is currently no evidence that Ledger's core infrastructure or device firmware was compromised.[1][4][7]
Key facts
- Ledger is investigating reports of lost customer funds among Southeast Asian users who purchased devices from reseller CryptoBilis.
- Ledger requested CryptoBilis pause all device sales and shipments, and warned anyone who purchased from the reseller within the past 90 days not to set up the devices or to move funds to a new seed phrase.
- On-chain investigator Specter tracked more than $86 million drained from hundreds of wallets across Bitcoin, Ethereum, and Tron into theft addresses.
- An Arkham Intelligence entity labeled 'ledger user theft' held $86,964,156.47 across 98 addresses, primarily in ETH, BTC, USDT, and USDD.
- Lookonchain reported total losses near $90 million, including one victim who lost 7 million USDT after purchasing a device three weeks earlier.
- Security researcher tanuki42 identified more than $72 million across eight addresses, leading the Security Alliance to direct victims to its SEAL 911 Telegram bot.
Sources · 9 sources
- UN
UnchainedArticle ·
Ledger Users Reportedly Drained of Over $86 Million Across Several Blockchains Specter (@SpecterAnalyst) said on X on Oct. 9 that a trace of theft addresses shows losses of more than $86 million from reported wallet drains of Ledger users . Specter said the addresses took in funds from hundreds of victims’ wallets on multiple major chains, among them Ethereum, TRON and Bitcoin . Specter cited user reports on X and Reddit of Ledger wallets being emptied, and said it traced the theft addresses. The post listed 10 addresses . Those addresses held only over $25 million as of last check, suggesting the majority of the funds have been moved. A post from tanuki42 published at 12:00 UTC asked anyone drained to contact SEAL 911 as soon as possible. The post said, “Total loss is >$72M+ and increasing.” It listed eight addresses , all of which also appear in Specter’s list of 10. Specter’s list adds two more bitcoin addresses and was posted at 12:24 UTC. The Security Alliance (SEAL) quote-posted tanuki42’s list at 12:29 UTC. It asked anyone whose funds were drained to those addresses to get in contact with the group as soon as possible through the SEAL 911 Telegram bot. Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . Ledger Cites a Reseller Ledger (@Ledger_Support) said at 13:32 UTC that it is investigating reports of lost funds from users in South East Asia who bought products from a reseller named CryptoBillis . Pending the results, Ledger said it asked the reseller to pause all sales and shipments of Ledger devices. Ledger recommended that users who bought from the reseller in the last 90 days not start setup if they have not done so. It said users who have already set up a device should “consider moving assets to a new Ledger signer (with new seed)” and that it will keep informing customers as the investigation progresses. Ledger’s post does not mention the $86 million tally or the addresses in the other posts, and does not say how many users or how much money is involved. This is still a developing story that will be updated… Related Listen: Inside the Coldcard Hack That Drained Over $100 Million in Bitcoin: Uneasy Money The post Ledger Users Reportedly Drained of Over $86 Million Across Several Blockchains appeared first on Unchained .
Open source - CR
Crypto Rover@cryptoroverPost on X ·
BREAKING: 🚨 Ledger reportedly hit by a HUGE exploit, with alleged losses reaching $86 MILLION. Hundreds of users reportedly had their entire crypto holdings drained. A Ledger-wide exploit remains UNCONFIRMED. https://t.co/4cFnMiLYAB
Open source - CB
Crypto Briefing@Crypto_BriefingPost on X ·
🚨NEW: Ledger is looking into reported losses among customers in Southeast Asia who bought its hardware wallets from reseller CryptoBilis. https://t.co/uRj2xOAwI7
Open source - LS
Laura Shin@laurashinPost on X ·
Earlier on Oct. 9, tanuki42 put the total at more than $72 million and listed eight addresses. Specter's later tally of 10 addresses reached $86 million+. The Security Alliance asked anyone drained to them to reach SEAL 911 on Telegram. https://t.co/ihGRcnnpCy
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨LEDGER USERS REPORT DRAINS WORTH $86M! Onchain investigator @SpecterAnalyst traced more than $86 million into theft addresses on Ethereum, Tron, and Bitcoin after Ledger users posted drain reports on X and Reddit. He said the money came from hundreds of wallets, and he still does not have a full count. @Ledger has not confirmed a device exploit.
Open source - LO
Lookonchain@lookonchainPost on X ·
Many #Ledger users who bought their devices from reseller CryptoBillis have had their funds stolen, with losses totaling nearly $90M. Stay safe!🚨 One user (TY24Ya) bought a Ledger device from CryptoBillis 3 weeks ago and deposited 7M $USDT into it. Just 10 hours ago, all 7M $USDT was stolen, possibly the largest loss among the victims. https://t.co/VARjqxL2Tn
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
World’s Largest Hardware Wallet Maker Ledger Investigates Wallet-Draining Reports; Onchain Analyst Estimates Losses Above $86M Ledger, the world’s largest hardware wallet manufacturer, said it is investigating reports of stolen funds involving users in Southeast Asia who purchased devices from reseller CryptoBilis. The company has asked CryptoBilis to pause sales and shipments during the investigation and advised customers who bought devices from the reseller within the past 90 days not to initialize them. Users who have already set up their devices were advised to move assets to a new Ledger signer using a new seed phrase. Separately, onchain investigator Specter said he traced suspicious addresses receiving funds from hundreds of victim wallets across Ethereum, TRON and Bitcoin, estimating total losses at more than $86 million. The common attack vector has not yet been confirmed, and there is currently no evidence that Ledger hardware wallets or Ledger’s core infrastructure were directly compromised.
Open source - QU
Quit@0xQuitPost on X ·
Still waiting on more details but it appears that an authorized Ledger reseller named CryptoBilis that serves the Philippines, Malaysia, and Indonesia has recently been serving up compromised devices. Unclear if they were sending genuinely tampered-with devices or just inserting premade seed phrases into the box. We'll have to wait for victim testimonies to learn more. For now be sure to always generate your own seed phrase. If a seed phrase is included in the device you've purchased or the device is already initialized and you're given a PIN to enter, alert the manufacturer and return the device. Ledger also allows you to run a genuine check, which provides cryptographic proof that the device has not been tampered with. If you've bought from CryptoBilis (or to be safe, any third party retailer) in the past 90 days, firstly you should move your funds. Secondly, I'd love to hear from you. Everybody else has nothing to worry about.
Open source - BL
BlockNews@blocknewsdotcomPost on X ·
🚨 ALERT: Ledger users are reportedly facing major crypto losses, with unverified estimates reaching $86 MILLION. Hundreds of users allegedly had their entire holdings drained, with some reports suggesting losses could approach $100 MILLION. https://t.co/Ld1rxsUiqG
Open source