Hardware wallet leader Ledger is facing a major cybersecurity incident that may involve its supply chain.
Ledger said it is investigating reports that assets belonging to multiple users in Southeast Asia were stolen. All of the users had purchased Ledger devices through authorized reseller CryptoBilis. As a precaution, Ledger has asked CryptoBilis to suspend all sales and shipments of Ledger products.
On-chain researchers currently estimate that the value of the possibly stolen assets may have exceeded $86 million, involving multiple blockchains including Bitcoin, Ethereum, and Tron. However, Ledger has not confirmed the actual amount of losses, the number of affected users, or whether the devices were actually tampered with, so these figures remain estimates as the investigation is ongoing.
Ledger orders Southeast Asian reseller to immediately suspend sales and shipments
Ledger said the reseller involved in the incident was CryptoBilis. The official Ledger reseller list shows that CryptoBilis is indeed one of Ledger’s authorized resellers in Indonesia, Malaysia, and the Philippines—not an unknown, unofficial seller.
This is also why the incident has drawn particular attention. General hardware wallet security advice usually recommends avoiding purchases from unknown third parties to reduce the risk of buying counterfeit or unsealed devices. But CryptoBilis, which is under investigation in this case, was on Ledger’s official list of authorized resellers. Ledger therefore says it has asked CryptoBilis to suspend all sales and shipments of Ledger devices while the investigation is ongoing.
CryptoBilis is a crypto retail company founded in 2020 and headquartered in Petaling Jaya, Selangor, Malaysia. It primarily sells hardware wallets and Web3-related products, and also runs crypto communities and in-person events.
CryptoBilis changed hands in March; new shareholders’ backgrounds become focus of investigation
CryptoBilis was initially co-founded by Arravind Prabu and Vimalatheethan. Arravind served as CEO for many years and, as recently as 2025, represented CryptoBilis at the Ledger Op3n and Nano Gen5 global launch event in Paris.
However, Arravind recently said that CryptoBilis was acquired by new owners in early 2026. After completing the handover with Vimalatheethan in March this year, he left all operational, management, and administrative roles at the company, and no longer has access to its backend systems, customer data, or order records.
Public company records show that CB International Sdn. Bhd. is the operating entity for CryptoBilis in Malaysia. Recently disclosed company records show that, as of August 3, a person publicly identified as “Jiaming,” whose registered address is in Heilongjiang Province, China, held 100% of the company’s shares.
On-chain researchers estimate losses exceeding $86 million
After tracking a group of suspected stolen-fund addresses on Bitcoin, Ethereum, and Tron, on-chain researcher Specter estimated that the related asset losses had exceeded $86 million.
According to tracking data cited by Decrypt, assets at the suspected addresses include around $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT, totaling nearly $87 million. Another researcher, tanuki42, gave a lower estimate, saying that more than $72 million in assets may have flowed to the suspected attacker addresses.
Ledger: Don’t power on devices bought in the past 90 days
Ledger’s security advice to users is quite clear, but it does not apply to all Ledger users. The company says that if you bought a Ledger device through CryptoBilis within the past 90 days and have not started setting it up, you should pause activation for now.
If you have already completed setup and deposited assets, Ledger recommends considering moving them to a new Ledger signing device and generating a completely new recovery phrase (seed phrase). The most important point is that you must not simply restore your old recovery phrase on another new Ledger.
If the issue really does involve a recovery phrase being stolen during the supply-chain process, importing the same 24-word recovery phrase into a new device would still leave the attacker able to control the same private key. The truly safe approach is to create a completely new recovery phrase and wallet address, then transfer the assets to them.
The possibility drawing the most attention in the market is a “supply-chain attack.”
Binance co-founder Changpeng Zhao (CZ) said that, based on the information currently available, the incident appears to be concentrated on a single supplier, and some users may have bought “counterfeit or tampered-with Ledger devices.”
Former Mt. Gox CEO Mark Karpeles also said he is investigating potentially related cases and advised victims to take apart their devices and photograph the circuit boards to check whether the hardware had been tampered with.
But these remain only avenues of investigation. Ledger has not confirmed that any devices were tampered with, nor has it confirmed a breach of Ledger firmware, the Secure Element, the security chip, or the company’s backend systems.
Why could a hardware wallet be stolen from, too?
The core security principle of a hardware wallet is to keep private keys offline on the device, rather than storing them on a computer or phone. But if an attack takes place before the user receives the hardware wallet, the security model changes completely.
For example, if someone obtains or replaces a user’s recovery phrase during the supply-chain process, then repackages and sells the device, the attacker could already have the same private key—even if the user never enters the recovery phrase on a computer. Another possibility is that the device itself was replaced or implanted with malicious hardware to trick the user into using a preconfigured recovery phrase.
It has not yet been confirmed what method was used in the CryptoBilis incident, but it highlights that hardware wallet security depends on more than the chip itself. The entire supply chain—from manufacturing and logistics to retail and delivery to the user—can be an attack surface.
There is currently no evidence that all Ledger users are at risk, which is also what makes this incident especially likely to cause panic.
Ledger’s warning is only for users who bought products from CryptoBilis in the past 90 days. It has not asked all Ledger holders worldwide to replace their devices. So if you bought your Ledger directly from the official store or another authorized retailer, you should not assume that your device was similarly affected because of this incident.
Even if the issue is ultimately confirmed to have occurred at only one reseller, the incident still has major implications for the hardware wallet industry. CryptoBilis was not an ordinary online seller; it was an authorized reseller listed on Ledger’s official website. If users are ultimately confirmed to have received tampered devices, that would mean the traditional security advice to “buy only from an officially authorized reseller” is still not enough to completely eliminate supply-chain risks.
Hardware wallet manufacturers may need to strengthen device authenticity checks, packaging integrity inspections, and hardware verification procedures during initial activation. For the self-custody market, this incident is a reminder that self-custody can eliminate the risks of an exchange collapsing or a third party misappropriating funds, but it cannot eliminate risks related to recovery phrase management, device sourcing, and the supply chain.
This article is reprinted with permission from: (BlockTempo)
Original title: (Ledger faces $86 million theft scare! Southeast Asian authorized reseller suspended, buyers from the past 90 days urged to switch wallets)
Original author: Anfei
The article “Authorized reseller hit by supply-chain crisis: Ledger investigates theft of over $86 million from Southeast Asian users” was first published on “Crypto City.”