Ledger buyers in Southeast Asia lose about $86 million after buying devices from reseller CryptoBilis

Ledger, the French hardware wallet maker, is investigating reports that customers who bought its devices from CryptoBilis had their wallets emptied. CryptoBilis is an authorized reseller serving Indonesia, Malaysia and the Philippines. The on-chain investigator Specter traced more than $86 million in suspected thefts across Bitcoin, Ethereum and Tron addresses. Decrypt reports that the losses include roughly $17.6 million in bitcoin, about $42 million on Ethereum and $16.5 million in Tron-based USDT. CryptoSlate puts the running total close to $90 million.

Individual losses are large. The on-chain analytics account Lookonchain reported that one holder lost all 80 bitcoin, bought for $5.2 million, after moving them to a Ledger purchased from the reseller.

Ledger asked CryptoBilis to pause all sales and shipments. It told anyone who bought from the reseller in the past 90 days not to set up the device. Buyers who have already set one up should move their assets to a new signer with a freshly generated seed phrase, according to BitPinas. Ledger said it has no loss reports for devices bought directly from the company and that its own infrastructure was not compromised. Ledger has not confirmed the loss figure or the cause. The reports this desk reviewed do not include CryptoBilis's account of what happened.

How the attack worked is still unproven. All of the evidence found so far points to the distribution channel. There is no sign of a break in the device's cryptography itself. There are three leading explanations. The first is that devices were set up before sale with a seed phrase the attacker recorded and then resealed in their packaging. The second is a hardware or firmware implant. The third is phishing that followed a leak of customer data. The French-language channel Goku Crypto News noted that on Sept. 2 the hardware researcher Joe Grand took apart a modified Ledger Nano X and found an implant with an antenna, memory and an embedded SIM (eSIM). That implant was designed to monitor the wallet rather than to break its security. Developers on Bitcointalk's technical board are debating which explanation fits the drain pattern.

Only part of the money can be recovered. Tether began freezing USDT at addresses linked to the drains, according to the blockchain security firm MistTrack. Bitcoin and ether have no issuer that can freeze them. Those parts of the loss can be recovered only if the thief sends them through an exchange that cooperates with investigators. No one has publicly identified the attacker. Goku Crypto News reported that Ledger is reviewing several separate loss reports.