Ledger Claims Stolen Funds Limited to Southeast Asia Dealer CryptoBilis Devices
Ledger stated on platform X that, based on current information, it believes the stolen funds are limited to devices sold through the Southeast Asia dealer named CryptoBilis, with no signs indicating that Ledger's security infrastructure, systems, or services have been compromised.
Ledger has requested CryptoBilis to suspend all sales and shipments, and advised users who purchased devices from this dealer in the past 90 days to refrain from initializing them, while those who have already initialized are encouraged to consider transferring assets to a new Ledger device and using a new seed phrase.
On-chain investigator Specter and others have tracked suspected losses exceeding $86 million, involving hundreds of victim wallets across Bitcoin, Ethereum, and Tron, but Ledger has not confirmed the specific amounts or reasons.
CryptoBilis is Ledger's officially authorized dealer in Indonesia, Malaysia, and the Philippines. An investigation was triggered after users reported stolen funds, with some analyses pointing to potential supply chain or device tampering.
Ledger emphasizes the importance of security reports, stating that the team is actively investigating the specific issues and reminding users to contact customer support through official channels, while being wary of scams involving fake migrations or requests for seed phrases.
In market mechanisms, hardware wallet users are affected by dealer channels, with funds flowing from victim wallets to attacker addresses; users who purchased directly from the official source are unaffected. Ledger is controlling reputational risk by suspending authorizations and making public statements, putting pressure on supply chain trust.
The investigation is ongoing, and the specific intrusion path and total losses have not yet been confirmed.
Source: Public Information
ABAB AI Insight
Ledger previously expanded its coverage in Southeast Asia through authorized dealers, with CryptoBilis as an official partner selling devices, continuing the practice of hardware wallet manufacturers relying on regional distribution to reduce direct operating costs while transferring some risks.
After the incident, Ledger quickly requested a sales suspension and issued user guidelines, focusing resources on official channel communication and investigation, motivated by the need to isolate supply chain issues and protect core product trust, avoiding a brand-wide spread.
This is similar to past cases of hardware wallet supply chain attacks or dealer tampering, such as reports of devices being implanted with backdoors. The current phase is transitioning from user reports to on-chain tracking and manufacturer confirmation, prioritizing the delineation of impact rather than immediate qualification.
Essentially, this represents a shift in supply chain risk and trust boundaries: authorized dealers become entry points for attacks, with the mechanism being that the physical device distribution stage is difficult to audit completely; if a single node is compromised, keys can be obtained in bulk, thus separating manufacturer security commitments from distribution execution and increasing end-user verification costs.
ABAB News · Cognitive Laws
Official authorization does not equal supply chain security
Risk transfers to distribution after devices leave the factory
Sales suspension is isolation, not a solution