Ledger traces an 86 million dollar wallet drain to a single reseller

Ledger is investigating reported crypto thefts of about 86 million dollars linked to wallet sales by the reseller CryptoBilis². BigGo Finance reported the company probing an 86 million dollar crypto drain tied to a Southeast Asian reseller⁴, and BitPinas reported that Ledger asked CryptoBilis, which is based in Malaysia and the Philippines, to pause sales amid user reports of drained wallets⁷.

U.Today reported Ledger investigating the theft reports⁶, and FXDailyReport reported the hardware wallet maker hit with an 86 million dollar theft⁵. The figure is as reported by users and has not been confirmed by any audit^2,5.

Reports of unauthorised outflows came from users rather than from the company, and Ledger’s response so far has been to investigate and to ask the reseller to stop selling^2,7. Neither Ledger nor the reseller has published a finding⁶.

Why it matters to investors

Binance co-founder Changpeng Zhao said the evidence points to a supply chain attack localised to one vendor, possibly involving counterfeit devices⁴. He attributed the thefts to a localised supply chain attack in a post on the platform X⁷, and pointed to compromised devices as the likely route². FXDailyReport also reported his view that the attack appears to involve a single vendor⁵. The assessment is his, not the company’s^4,7.

Crypto-Economy reported Zhao recommending a wait of at least two weeks before a newly purchased hardware wallet is trusted with substantial crypto, which is an admission that a buyer cannot verify a device on receipt¹.

The significance is not the amount but the attack surface. Hardware wallets are sold on the premise that self-custody removes counterparty risk. An attack executed through the distribution channel reinstates a counterparty, the reseller, at the point of purchase rather than the point of storage^4,7. Insurance, audit and custody arrangements built around exchange failure do not address that.

What to watch

Zhao urged crypto investors to impose a strict “quarantine” period on new hardware wallets³, recommending waiting at least two weeks before trusting a newly purchased device with substantial holdings¹. That is practical advice rather than a fix, and it points to the open questions.

Watch whether Ledger’s investigation confirms the thefts were confined to CryptoBilis or finds other resellers affected, which is the difference between a vendor failure and a channel failure^2,7. Watch whether the devices involved turn out to be counterfeit or genuine units that were tampered with, since the two imply different controls⁴. And watch whether Ledger moves from asking a reseller to pause sales to revoking authorisation outright⁷.