Ledger is investigating wallet drains reported by customers in Southeast Asia who bought their devices from a reseller called CryptoBilis. Ledger says every confirmed case so far involves devices sold through that reseller, and that its own systems and direct sales are not affected. On-chain researchers put the losses somewhere between $72 million and $93 million. How the devices were compromised is still not confirmed.

What Ledger has said

Ledger asked CryptoBilis to pause sales and shipments, and told people who bought from it in the past 90 days not to set up those devices. In its 72-hour update, Ledger said all confirmed cases involve CryptoBilis devices, its own systems and direct sales are unaffected, and CryptoBilis has stopped selling hardware wallets.

The numbers, and why they differ

The widely quoted figure of more than $86 million came from an on-chain investigator who published the addresses linked to the drains, across Bitcoin, Ethereum and Tron. Analytics firm Bitquery later counted about $93.2 million taken from 315 wallets on six blockchains. Ledger hasn't confirmed a dollar figure, and the number of victims is still being worked out. Treat every total as an estimate for now.

What isn't known yet

Reports disagree on the cause. Some say a tampered device was found. Others say the method is unconfirmed. Until Ledger says more, the safe reading is simple: the problem is tied to where the devices were bought, not to Ledger devices bought directly. We explained how to check a device for tampering in our Ledger spy implant guide.

What to do

  • Buy a hardware wallet only from the maker's own store.
  • Never use a recovery phrase that came printed in the box. A real device makes you write down a new one.
  • If you bought from a reseller, move your funds to a new wallet set up from scratch on a device from the maker.
  • Not sure which wallet you need? Start with hot wallet vs cold wallet.

Sources: The Block, Decrypt, Protos, Finance Magnates.