Ledger investigates fund losses linked to Southeast Asian reseller, warns users

Hardware wallet maker Ledger is investigating reports of cryptocurrency losses involving devices purchased from a Southeast Asian reseller, warning affected customers to consider moving their assets to new wallets while the investigation continues.

In a statement posted on X, Ledger said it had asked reseller CryptoBilis to suspend sales and shipments of its devices as a precaution. Customers who purchased devices from the reseller within the past 90 days were advised not to set them up, while those who had already done so were advised to consider transferring their assets to a new Ledger signer with a newly generated recovery phrase.

CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.

Ledger has not disclosed how many customers may be affected or the value of the reported losses. The company also has not identified the cause of the incidents or confirmed whether the devices were compromised.

Separately, onchain researchers reported suspected cryptocurrency thefts involving addresses across several blockchains. Researcher tanuki42 identified eight wallet addresses allegedly linked to more than $72 million in losses, while fellow investigator Specter estimated losses exceeding $86 million across Bitcoin, Ethereum and Tron.

Ledger has not confirmed either estimate, and the extent of any connection to the CryptoBilis investigation remains unclear.

Crypto security organization Security Alliance (SEAL) amplified tanuki42’s findings on X, urging anyone whose funds were transferred to the identified addresses to contact its incident-response team. The organization did not provide an independent estimate of losses or identify a cause for the suspected thefts.

In a statement to Cointelegraph, Ledger said the incident appeared to be isolated to the reseller and affected market, adding that it had received no reports involving devices purchased directly from the company.

“Ledger’s infrastructure, systems and services were not compromised,” the company said, adding that its investigation remains ongoing.