Ledger ties all confirmed cases in suspected $86M drain to reseller CryptoBilis
In brief
- Ledger said all confirmed draining cases involved devices sold through reseller CryptoBilis.
- Ledger said its own systems and direct sales channels were unaffected.
- CryptoBilis confirmed it stopped all hardware wallet sales, according to Ledger.
- Specter, an onchain investigator, traced more than $86 million in suspected thefts; Ledger hasn't confirmed the figure.
- YFarmX's fund-flow analysis hasn't been independently verified.
What Ledger has (and hasn't) confirmed
Ledger began investigating on Friday after users in Southeast Asia who bought devices from CryptoBilis reported losing funds. The company said the volume of impacted devices was limited, and that it's working with relevant authorities and reaching out to affected users.
"We know this is concerning, especially for those directly affected, and we are reaching out to impacted users."
Ledger, in its 72-hour update posted on X
Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. Ledger hasn't confirmed that figure.
It also hasn't said what caused the losses.
Where the funds went, according to YFarmX
Onchain investigators YFarmX said they'd sent Ledger a list of more than 450 drained wallets. Their analysis (which hasn't been independently verified) says the thief moved 2,810 ETH through Tornado Cash in three runs, routed withdrawals through Zcash's shielded pool and withdrew about 3.28 million USDC into three fresh wallets that Circle could freeze.
YFarmX also said 15 million stolen USDT was converted into USDD. About 5.1 million was swapped back into USDT, and roughly 4.23 million USDT went to Binance deposit addresses. Tether froze 10 million USDT on the first day, according to YFarmX's findings, while 15,475 ETH, 203 BTC and 10 million USDD remained out of reach.
Ledger's guidance, and unverified claims from Europe
Ledger's advice to CryptoBilis buyers hasn't changed: don't set up unused devices. Anyone who already has should move funds to a new seed phrase on a device bought from Ledger. The company warned that scammers might try to exploit the incident, and said it will never call users, DM them or ask for their 24-word recovery phrase.
It's also reminding authorized resellers and distributors to source products only through authorized channels and never to restock returned products. Ledger said it's reviewing reseller controls and advancing hardware protections, and it asked others in the industry to work with it on supply-chain and anti-tamper practices.
Separately, an X user named Johannes claimed he found tampered Ledger devices in Europe after buying two from retail stores. He said both had identical modifications (including additional cables and an LTE module) and called on Ledger to issue a product recall. He's sending the second device to Ledger for analysis. Those claims haven't been independently verified, and Ledger's update said all confirmed cases so far involve CryptoBilis devices.
Frequently asked questions
What should people who bought a Ledger from CryptoBilis do?
Ledger said CryptoBilis buyers shouldn't set up unused devices. Anyone who already has should move funds to a new seed phrase on a device bought directly from Ledger.
Has Ledger confirmed how much was stolen or what caused the drain?
No. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin, but Ledger hasn't confirmed that figure or said what caused the losses.
How can users avoid scams tied to the Ledger incident?
Ledger warned that scammers might try to exploit the incident. The company said it will never call users, DM them or ask for their 24-word recovery phrase.
