Multiple users who purchased Ledger hardware wallets from dealer CryptoBillis have reported stolen funds, with tracked losses approaching $90 million. Ledger's support account has expanded the investigation to Southeast Asia, targeting users who bought devices from this dealer, and has requested the dealer to suspend sales and shipments. The company refers to the dealer as CryptoBillis in one instance and CryptoBilis in another.

Lookonchain detected a single-user transfer. A user identified by the address TY24Ya purchased a Ledger from CryptoBillis three weeks ago, deposited $7 million USDT, and approximately 10 hours ago, all funds were transferred out. The platform claims this could be one of the largest single losses in this incident. MistTrack did not separately confirm the $7 million, and Ledger has not disclosed this address.

The cumulative figures come from different tracking sources. Tanuki42 previously estimated losses exceeding $72 million, while Specter later estimated over $86 million, covering Bitcoin, Ethereum, and Tron. MistTrack traced the related losses to nearly $90 million and stated that Tether is freezing large amounts of USDT in multiple related addresses. Freezing does not automatically refund or cover Bitcoin and Ethereum that have already been transferred out.

The official recommendation remains limited to a 90-day window. Buyers who have not initialized their devices should not set them up; those who have set them up should consider using new recovery phrases to transfer assets to new Ledger signing devices. CryptoBilis is listed as an official dealer in Indonesia, Malaysia, and the Philippines. Decrypt reported that device tampering has not been confirmed. There are no official conclusions regarding the cause, technical path, or identity of the attacker.

Binance co-founder Changpeng Zhao posted on the same day, stating that based on current information, the incident seems limited to one supplier, and a few individuals may have purchased counterfeit or tampered devices. This is his judgment, not Ledger's investigation conclusion.

This is not a transaction but a transfer of user funds through the distribution channel. The buyer is the tracked receiving address, and the seller is the CryptoBillis buyer who has completed setup and deposited assets. The incident is driven by user reports and on-chain monitoring, not market conditions. Beneficiaries are buyers who have not initialized their devices or have migrated assets with new recovery phrases within the 90-day window; the pressured party includes users like TY24Ya who have deposited large amounts of USDT into these channel devices, as the $7 million is only marked by monitoring parties and the company has not confirmed tampering.

Nearly $90 million is a cumulative figure across multiple chains, while $7 million is a single USDT transaction. The two figures cannot be added together or substituted for each other.

Source: Public Information