Ledger's support account posted on October 9 at 13:32 UTC, stating that it is investigating reports of fund losses from Southeast Asian users who purchased devices from the dealer CryptoBilis. The company mistakenly referred to the dealer as CryptoBillis in one instance. As a precaution, the dealer has been asked to suspend all sales and shipments until the investigation results are available.

The official advice is divided into two categories. Users who purchased from this dealer within the last 90 days and have not initialized their devices should not start the setup process. Those who have completed the setup should consider transferring their assets to a new Ledger signing device and use a new mnemonic phrase. Further updates will be provided through official channels. CryptoBilis is listed as an official dealer in Indonesia, Malaysia, and the Philippines, and sells multiple hardware wallet brands.

On-chain estimates exceed the official confirmed range. Tanuki42 reported at 12:00 that losses have surpassed $72 million and are still increasing, listing 8 addresses and urging affected users to contact the security response organization SEAL 911. Specter raised the estimate at 12:24 to over $86 million, tracking across Ethereum, Tron, and Bitcoin, initially citing hundreds of affected wallets, later clarifying that the actual number of wallets has yet to be determined. Specter listed 10 addresses, 8 of which overlap with the previous list.

Decrypt cited Arkham data shared by Specter, indicating that the related addresses total nearly $87 million, with approximately $42 million in Ether, $17.6 million in Bitcoin, and $16.5 million in Tether. When Unchained verified, these addresses had over $25 million remaining, showing that most of the funds had already been transferred out. Ledger has not confirmed the amounts or whether each theft is related to this dealer.

Decrypt reported that tampering has not yet been confirmed. The reasons and whether the involved devices have security vulnerabilities are still under investigation. The Block has inquired with Ledger, but the public statement did not provide a response from the dealer.

This is not a transaction on an exchange, but a transfer of funds within the hardware wallet supply chain. The buyers are the traced receiving addresses, while the sellers are the Southeast Asian users reporting fund losses. The event was driven by user theft reports on social media and forums, as well as the official request to cease sales. Beneficiaries are buyers who have remained on uninitialized devices or have transferred assets after changing their mnemonic phrases; those under pressure are users who received and completed setup from CryptoBilis in the past 90 days, as the $86 million is only an estimate by investigators, and the official reasons and confirmation list have not yet been provided.

The two estimates differ in the number of addresses and time. The $72 million corresponds to 8 addresses, while the $86 million corresponds to 10 addresses, and the latter figure has not yet been confirmed by Ledger.

Source: Public Information