Ledger: Wallet Draining Linked to Reseller, Not Company Systems
What owners should do with unused devices
Ledger said every confirmed case in the Ledger wallet theft incident involves devices sold by a single Southeast Asian Ledger reseller, CryptoBilis. The Paris-based hardware wallet manufacturer said its own systems and direct sales channels remain unaffected, a distinction intended to reassure thousands of owners who bought devices directly from the company.
CryptoBilis has stopped all hardware wallet sales following the incident. Ledger described the number of impacted devices as limited and said it is contacting affected users and working with authorities. The investigation into the cryptocurrency theft began Friday after Southeast Asian customers reported losses, but the company has not independently confirmed how much money moved.
Onchain investigator Specter estimated more than $86 million in suspected losses across Ethereum, Tron and Bitcoin networks. Another firm, YFarmX, sent Ledger a list of over 450 drained wallets and traced specific laundering paths used in the wallet draining scheme. The attacker sent 2,810 ETH through the Tornado Cash mixer in three separate runs and routed withdrawals through Zcash’s shielded pool.
The operation also converted 15 million USDT into USDD, a stablecoin Tether cannot freeze, then swapped 5.1 million back into USDT. About 4.23 million USDT ended up at Binance deposit addresses, while Tether froze 10 million USDT on the first day. Roughly 15,475 ETH, 203 BTC and 10 million USDD remain unreachable. These findings have not been independently verified.
Separate claims surfaced on X, where an account named Johannes said he found tampered Ledger devices in European retail stores. He reported identical modifications, including additional cables and an LTE module, and asked Ledger to issue a product recall. Ledger’s update did not validate these reports, stating all confirmed cases involve CryptoBilis devices. Johannes said he is sending the second device for analysis.
Ledger warned authorized resellers to source products only through authorized channels and to never restock returned items. The company suggested that someone returning a compromised unit could have reintroduced a modified device into inventory. Buyers are told to avoid unauthorized sellers where counterfeit or tampered hardware carries higher risk.
For owners of devices from CryptoBilis, Ledger advised against setting up unused units and to move existing funds to a new seed phrase on a device purchased directly from the manufacturer. Hardware wallets store private keys offline, meaning a compromised seed phrase allows full access to connected funds.
The manufacturer said it is reviewing reseller controls and advancing hardware protections. It also urged industry peers to collaborate on supply-chain and anti-tamper practices. Scammers often exploit security incidents, so Ledger reminded users it will never call, DM, or ask for a 24-word recovery phrase.
