Ledger Hack Drains Up To $87 Million From Buyers Of One Southeast Asian Reseller
Ledger is investigating a wave of drained wallets tied to a single Southeast Asian reseller, and nobody tracking the money on-chain agrees yet on exactly how big the number is.
THE NUMBER WON'T SIT STILL
On October 9, pseudonymous on-chain investigator Specter published ten collection addresses on Bitcoin, Ethereum and Tron and put the total above $86 million, after tracing inflows from hundreds of wallets flagged by Ledger users on X and Reddit. A second researcher, tanuki42, identified eight addresses and landed on a lower figure, just over $72 million. By evening, blockchain security firm MistTrack pushed the estimate closer to $90 million, and Bitquery later traced $92.9 million across 311 wallets on five chains. Specter broke down roughly $87 million of it by asset: about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT.
A RESELLER IN KUALA LUMPUR, NOT A LEDGER BREACH
Ledger's support account confirmed the investigation on October 9, saying it was looking into "reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis." The reseller, more commonly spelled CryptoBilis, is listed on Ledger's own distributor page as an authorized seller for Malaysia, Indonesia and the Philippines, and was founded in Kuala Lumpur in 2020. Ledger asked CryptoBilis to pause all sales and shipments while the investigation runs, and told anyone who bought a device from the reseller in the past 90 days not to initialize it. Buyers who already set one up were told to move their assets to a new Ledger signer with a freshly generated seed phrase. Ledger said its own infrastructure was not compromised.
TWO COMPETING THEORIES
Binance co-founder Changpeng Zhao called it a supply-chain attack localized to one vendor. Former Mt. Gox chief executive Mark Karpelès went further, saying a device he personally examined carried an implant hidden under its screen that still passed Ledger's authenticity check, and he asked CryptoBilis to open unsold units so their circuit boards could be inspected. Security researcher Taylor Monahan pushed back on the scarier read, writing there is "absolutely not" a zero-day vulnerability in Ledger's hardware, and warning that panicked posts about drained wallets were creating openings for phishing links and fake migration tools.
WHAT TO DO IF YOU BOUGHT FROM CRYPTOBILIS
If your device came from CryptoBilis in the last 90 days and you have not set it up, don't. If you already have, move funds to a new device with a new seed now, not later. For everyone else, the lesson is the boring one hardware wallet buyers keep relearning: buy direct from the manufacturer or from a verified in-person seller, ship to a address you control, generate your own entropy, and never reuse a receiving address. None of that fixes what already happened to CryptoBilis buyers. It just keeps the next reseller from writing the next version of this story.
This story comes from the Simply Bitcoin Live show. Watch the full episode.
