Ledger Halts Southeast Asian Reseller After Up to $93 Million Is Drained From Customers' Wallets

Ledger, the French hardware-wallet maker, has asked CryptoBilis, its reseller in Malaysia, Indonesia and the Philippines, to pause all sales and shipments of Ledger devices. The request came after owners of devices bought through that channel found on October 9 that their funds were gone. Users first raised the problem on the Bitcointalk technical forum, and the loss estimates have risen since then. The on-chain analyst Specter traced ten collection addresses and put losses above $86 million. Bitquery counts $92.9 million taken from 311 wallets on Tron, Bitcoin, Ethereum, BNB Chain and Polygon.

The method is not confirmed. The explanation that investigators currently favor is physical tampering. Mark Karpelès, the former chief executive of the Mt. Gox exchange, said he bought a Ledger device in Malaysia with its shrink wrap intact and found a concealed electronic implant behind the screen padding. The implant is reported to capture the recovery words that control a wallet (the seed phrase). His account has not been independently verified. Ledger says it has no indication that its own security infrastructure or services were compromised. It has also not accused CryptoBilis of altering devices. Nothing public yet shows whether the tampering happened at the shop, inside its warehouse, or earlier in the supply of counterfeit goods.

Ledger has told anyone who bought from the reseller in the last 90 days not to set up an unopened device. Buyers who already set one up should move their assets to a new device with a newly generated recovery phrase. If the implant account holds, Ledger's built-in check that a device is genuine would not have caught it. That check confirms the secure chip, and an added part that copies the words shown on the screen would not alter the chip.

The theft comes as large holders reconsider how they hold their keys. Changpeng Zhao, the founder of Binance, published a short guide to self-custody and estate planning on October 10. It opens with the line "Nothing is completely secure" and tells holders to match their protection to the value they hold. On the same day, Meanwhile, a Bermuda-regulated bitcoin life insurer backed by Bain Capital Crypto and Sam Altman, raised $37.5 million to serve wealthy families who want to pass on their bitcoin. The company has now raised more than $180 million.

Ledger and its competitors have different interests in how this story is told. If the cause is tampering in the supply chain, Ledger's firmware and secure element remain uncompromised, and the failure belongs to the sales channel. Rival device makers and custodial providers gain if buyers come to see the devices themselves as the weak point.