Ledger is investigating reports of cryptocurrency losses among Southeast Asian users who bought its devices from CryptoBilis, a reseller listed in Ledger’s official directory. On Friday, Oct. 9, Ledger asked the seller to pause all sales and shipments of Ledger devices while the review continues, according to Ledger Support’s advisory.
CryptoBilis has since posted a notice on its website saying it paused Ledger-device sales and shipments and is cooperating with Ledger’s investigation. It asks customers who report losses to retain their device and packaging, contact its listed support channels, and never share recovery phrases or PINs.
Ledger’s Advice for Recent Buyers
The advisory applies to customers who bought from CryptoBilis in the 90 days before Ledger’s post. The company recommends:
- Not yet set up: Do not initiate setup on the device.
- Already set up: Consider moving assets to a new Ledger signer with a newly generated recovery phrase, or seed.
Ledger said it would provide updates as the investigation progresses and directed customers to its official support channels. CryptoBilis also warned buyers not to follow links asking them to connect a wallet, enter a recovery phrase or install software. Those warnings are useful while the incident is unresolved, since scammers may use security alerts to solicit seed phrases.
The $86 Million Figure Is an Estimate
Pseudonymous on-chain investigator Specter estimated that suspected outflows exceeded $86 million across Bitcoin, Ethereum and Tron addresses, CoinDesk reported. Ledger has not confirmed that figure. It is an independent estimate, not a company-reported loss total.
On-chain tracing can show transfers between addresses, but it does not by itself establish how many customers were affected, whether every reported case is connected, or how the wallets were accessed. The Block reported that researchers produced separate estimates, including one above $72 million. The reports do not establish a final amount or a confirmed count of affected users.
Ledger Says Its Systems Show No Sign of Compromise
In a later post, Ledger said that, based on information available at the time, it believed the reported fund drains were limited to devices sold through CryptoBilis in Southeast Asia. The company added that it had no indication its security infrastructure, systems or services had been compromised, according to Ledger’s main account. That is the company’s current assessment, not a final explanation for the losses.
A separate device-tampering claim has circulated. Former Mt. Gox chief Mark Karpelès posted photos of a Ledger device he said came from Malaysia and contained a concealed physical modification. He has not linked that unit to CryptoBilis, and public reporting has not tied it to the reported losses. Gizmodo reported that the source of the device and its connection to the investigation remain unconfirmed. Ledger has not said that an implant or other hardware change caused the reported fund losses.
Authorized Listing Does Not Establish Fault
Ledger’s official reseller directory lists CryptoBilis as a reseller. That confirms the business was included in Ledger’s sales network; it does not show that CryptoBilis altered devices, knew of a problem or caused the losses. The company’s request to pause sales was described as a precaution while its investigation proceeds.
The episode puts attention on the supply chain behind self-custody. Hardware wallets are designed to keep signing keys offline, but buyers still rely on devices reaching them in the condition intended by the manufacturer. BullBuzz has separately covered the U.S. debate over rules for self-custody wallets and a Bitget exchange breach. Those stories involve different systems and are not connected to the CryptoBilis investigation.
What the Investigation Still Needs to Establish
Ledger has not given a final account of the cause, how many people may be affected, the total confirmed losses or whether the reports share a single point of exposure. The public record also does not connect the device Karpelès described to CryptoBilis. The reseller’s notice says it is cooperating, but Ledger has not announced a timetable for its findings.
For now, the confirmed steps are Ledger’s investigation and buyer guidance, its request that CryptoBilis pause Ledger-device sales and shipments, and CryptoBilis’s statement that it has paused those sales and is cooperating. Buyers should follow updates through Ledger’s official support channels. The loss estimate, affected-user count, cause and any broader Ledger compromise remain unconfirmed.