Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen

Crypto hardware wallet maker Ledger said on Friday that it is investigating reports of stolen funds linked to devices sold through CryptoBilis, an authorized reseller operating in Southeast Asia, after onchain researchers flagged large-scale thefts from hundreds of self-custody wallets.

Pseudonymous blockchain investigator Specter said on X that more than $86 million in cryptocurrency may have been drained from wallets across Bitcoin, Ethereum and TRON. Ledger acknowledged the reports of missing funds from customers who purchased devices through the reseller, but it has not confirmed the loss figure, the number of affected users, or the cause of the thefts. As of now, neither the total amount nor the link between the devices and the losses has been independently verified.

A separate analysis published by blockchain analytics firm Bitquery put the figure higher, estimating roughly $92.9 million taken from 311 wallets across five networks: Bitcoin, Ethereum, TRON, BNB Chain and Polygon. Bitquery reported that the activity appeared coordinated, with groups of wallets signing identical approval transactions within seconds of one another — a pattern it said suggests a single actor may have held the keys to many of the affected addresses. The firm's timeline describes small test transactions over roughly two weeks before the bulk of the funds moved. Arkham Intelligence separately tracked around $87 million across related wallets, reportedly including meaningful amounts of ETH, BTC and USDT.

As a precaution, Ledger said it asked CryptoBilis — which the company says operates across Malaysia, Indonesia and the Philippines — to pause all sales and shipments while the investigation continues. Ledger advised recent buyers not to set up their devices, and said customers who had already activated a wallet purchased through that channel should consider moving their assets to a new device initialized with a newly generated recovery phrase. The company stated that its own systems and the devices it sells directly have not been compromised.

One theory circulating among researchers is a supply-chain attack, in which devices are tampered with somewhere between the manufacturer and the end customer. Binance co-founder Changpeng Zhao said he believed the thefts pointed to a supply-chain compromise tied to a single vendor, and called on the wider industry to help trace and secure the funds. Former Mt. Gox chief executive Mark Karpelès posted images on X of what he described as a modified Ledger device containing a hidden implant, arguing that such hardware could in principle capture a recovery phrase while it is displayed during setup. None of these claims have been confirmed by Ledger, and the company has not said whether any devices were in fact altered.

Some of the funds have been partially contained. Bitquery reported that Tether froze roughly $10 million in USDT held across about 20 addresses connected to the thefts, while a portion of the stolen stablecoins was swapped into USDD, a stablecoin Tether cannot freeze. Researchers also traced transfers through cross-chain bridges and swap services, with a large tranche of USDT moved from TRON to Ethereum and converted into ether.

The episode is notable because hardware wallets are widely used specifically to keep private keys offline and away from exchange or online-wallet risk. If tampering in the distribution chain is ultimately confirmed as the cause, it would highlight a different category of risk — one centered on where and how a device is bought rather than how it is used. Ledger's investigation is ongoing, and figures reported so far come from third-party researchers rather than the company itself.

This is a news summary for general information only — not financial advice, and nothing here is a recommendation to buy, sell, or hold any asset. Always verify against the original source and do your own research before making a financial decision.