BTC $82,813 
ETH $2,487 
USDT $0.9993 
BNB $740.04 
XRP $1.38 
USDC $0.9997 
SOL $109.63 
TRX $0.3325 
FIGR_HELOC $1.03 
ZEC $1,218 Ledger probes reported $86M wallet drain tied to reseller CryptoBilis
Ledger says it is investigating reported losses from users in Southeast Asia who bought devices from a reseller called CryptoBilis.
Key takeaways
- Losses top $86 million. Onchain investigator Specter compiled total losses above $86 million, led by more than $42 million in ETH.
- One reseller is in focus. Ledger asked CryptoBilis to pause sales and told buyers from the last 90 days not to set up devices.
- No wider flaw documented. Some experts said there is no evidence of a broader vulnerability across Ledger devices, Arkham counted nearly $30 million in stolen ETH.
What happened
Ledger said it is investigating reports that crypto was drained from its hardware wallets, and warned users against activating devices bought from a particular reseller. In an X post, the wallet maker said the reports came from users in Southeast Asia who purchased products from a reseller named CryptoBilis. Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices while the investigation continues.
Users said funds left their wallets even though they had protected their wallet and seed phrase and had not signed any transaction that moved funds. One purported user on Reddit said a Ledger wallet was drained of almost 100k USDT.
Onchain investigators pointed to funds leaving wallets across Bitcoin, Ethereum, Tron and other blockchains. Data compiled by an investigator known as Specter put total losses above $86 million as of Friday morning, with over $42 million in ETH, $17.5 million in BTC and $16.5 million worth of USDT.
Ledger recommended that users who bought from this reseller in the last 90 days not initiate setup, and cautioned users against activating wallets bought from that company. It advised owners of those wallets to consider moving assets to a new Ledger signer with a new seed.
Why it matters
The episode puts attention on the supply chain that moves a hardware wallet from maker to buyer. Binance co-founder and former CEO Changpeng Zhao said the information so far suggests the problem is localized to a supply chain attack with one vendor.
Some industry experts said there is currently no evidence of a broader vulnerability across Ledger devices. Ledger said it will continue to inform customers of updates as the investigation progresses.
What the data shows
Arkham data showed that hackers stole nearly $30 million in ETH from users of the wallet provider. Another 211 BTC, worth around $17.55 million, were drained from user wallets, and users also lost USDD and USDT on the Tron network.
Claims of losses from user wallets run as high as $86 million.
Background
The reports arrive amid wider concern about crypto security. In August, hardware wallet maker Trezor disclosed a data breach that affected nearly 14,000 customers, and exchange Bitget suffered a hack last month that let hackers steal up to $351 million in XRP, ETH and other assets.
What is still unclear
- There is currently no evidence of a broader vulnerability across Ledger devices, according to some industry experts.
- The reported losses are said to total up to $86 million, a figure tied to user claims and onchain investigation.
Questions readers ask
What happened with Ledger wallets?
Ledger said it is investigating reports of loss of funds from users in Southeast Asia who bought devices from a reseller named CryptoBilis. The company asked the reseller to pause all sales and shipments of Ledger devices.
How much crypto was drained?
Onchain investigator Specter compiled total losses above $86 million as of Friday morning, including over $42 million in ETH, $17.5 million in BTC and $16.5 million in USDT. Reported drains are said to total up to $86 million.
What did Ledger tell customers to do?
Ledger recommended that buyers from the last 90 days not initiate setup of their devices. It also advised users who set up a device to consider moving assets to a new Ledger signer with a new seed.
