Ledger is investigating reports that customers in Southeast Asia have lost cryptocurrency funds after purchasing its hardware wallets through reseller CryptoBillis. Blockchain analytics firm Arkham reported that more than $80 million was reportedly taken across Bitcoin, Ethereum, and Tron. However, neither Ledger nor Arkham has confirmed how the losses occurred.
In response, Ledger asked CryptoBillis to stop selling and shipping its devices while the investigation continues. The warning applies to customers who purchased wallets from the reseller within the past 90 days.
Customer Guidance
Ledger advised customers who have not yet configured recently purchased devices to avoid doing so for now. Customers already using a device from CryptoBillis should consider moving their assets to a new Ledger device protected by a new recovery phrase—the set of words that grants access to a wallet. Creating a new recovery phrase prevents anyone who may know the previous phrase from accessing the replacement wallet.
Ledger also instructed customers to contact the company only through official support channels. The company did not identify affected device models or confirm that any Ledger product had been altered.
Tracked Funds and Estimates
Arkham created a "ledger-drainer" label covering 152 addresses to track the suspected stolen funds across blockchains. At the time of reporting, the labeled wallets held approximately $71.6 million, including around $29.4 million in Ether, $17.68 million in Bitcoin, $13.65 million in USDD, and $10.85 million in USDT.
The tracked balance does not represent the total suspected loss, as funds may have already moved out of these wallets and fluctuating cryptocurrency prices affect the dollar value. Arkham reported the theft as above $80 million, while some other investigators cited figures of more than $86 million. Ledger has not confirmed the actual amount, so available figures remain estimates.
No confirmation has been provided regarding what caused the reported theft, and there is no confirmation of a company-wide Ledger exploit.
