Ledger has confirmed that all verified cases in last week's wallet-draining incident involve hardware wallets sold through Southeast Asian reseller CryptoBilis. The company said the volume of affected devices is limited and that its own systems and direct sales channels were not compromised.
Ledger said it is working with relevant authorities and reaching out to affected users. CryptoBilis has confirmed it has ceased all hardware wallet sales, according to the company's 72-hour update issued Sunday.
Scale of the Incident
Onchain investigator Specter identified more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin. Ledger has not confirmed that figure or disclosed the cause of the losses.
Onchain investigators YFarmX reported identifying more than 450 drained wallets. According to their analysis, the attacker moved 2,810 ETH through Tornado Cash, routed funds through Zcash's shielded pool, and withdrew approximately 3.28 million USDC into fresh wallets that Circle could freeze.
The stolen USDT was partially converted to USDD, a stablecoin Tether cannot freeze, before approximately 4.23 million USDT was sent to Binance deposit addresses. Tether froze 10 million USDT on the first day, while 15,475 ETH, 203 BTC, and 10 million USDD remain unrecovered, according to YFarmX. These findings have not been independently verified.
European Reports Unconfirmed
An X user claiming to have purchased two Ledger devices from European retail stores reported finding identical modifications including additional cables and an LTE module. He called for a product recall. Ledger's update stated that all confirmed cases so far involve CryptoBilis devices. These European claims have not been independently verified.
Reseller Controls and User Guidance
Ledger reminded authorized resellers and distributors to source products only through authorized channels and to never restock returned products. The company warned users against purchasing from unauthorized resellers, where the risk of counterfeit or modified devices is elevated.
Ledger advised CryptoBilis buyers not to set up unused devices and recommended that anyone who already set up a device move their funds to a new seed phrase on a wallet purchased directly from Ledger. The company cautioned that scammers may attempt to exploit the incident and reiterated that it will never request users' 24-word recovery phrases through calls, direct messages, or other unsolicited contact.
