Ledger Probes SE Asia Reseller After Reported Fund Losses

Hardware wallet manufacturer Ledger is investigating reports of cryptocurrency losses tied to devices bought through a Southeast Asian reseller, urging potentially affected customers to pause setup and, where applicable, move funds to fresh wallets while the review continues.

Separately, independent on-chain analysts have circulated suspected wallet-theft claims across multiple networks, estimating losses in the tens of millions. Ledger has not confirmed any connection between those allegations and the reseller-linked incidents.

Key takeaways

• Ledger says the issue appears limited to a specific reseller and does not involve devices purchased directly from the company, based on its initial assessment.
• Customers who bought from CryptoBilis within 90 days should not set up the device, according to Ledger’s guidance.
• Ledger advises users who already set up a device to transfer assets to a new Ledger wallet generated with a newly created recovery phrase.
• Ledger has not disclosed how many customers were affected or the total value of reported losses, and has not identified a cause.
• On-chain analysts have alleged much larger suspected theft totals, but Ledger has not validated those figures or confirmed any link.

Ledger requests action for customers buying via CryptoBilis

In a statement posted on X, Ledger said it has asked the reseller CryptoBilis to suspend sales and shipments of its devices as a precaution while the company investigates reports of cryptocurrency losses involving those products.

Ledger’s warning specifically targets customers who purchased devices from CryptoBilis within the past 90 days. For that group, Ledger recommended that they do not set up the hardware wallets until the investigation is completed.

For customers who already configured devices, Ledger advised them to consider transferring their assets to a new Ledger signer created with a newly generated recovery phrase. The company framed this as a practical step in response to the losses being reported, even though Ledger has not confirmed the underlying cause.

Ledger lists CryptoBilis as an authorized reseller in Indonesia, Malaysia, and the Philippines.

What Ledger has (and hasn’t) confirmed

Ledger has not disclosed how many customers may have been affected, nor has it provided an estimate of the value of the reported losses. The company also has not publicly identified the mechanism behind the incidents or confirmed whether any devices were compromised.

In comments provided to Cointelegraph, Ledger said the incident appears to be isolated to the reseller and the affected market, and that it has received no reports involving devices purchased directly from Ledger.

Ledger also stated: “Ledger’s infrastructure, systems and services were not compromised,” while emphasizing that the investigation is ongoing.

For users, the key implication is that Ledger is currently steering its response toward reseller-channel risk rather than broader system compromise. However, because Ledger has not yet explained how the losses occurred, customers should be cautious about assuming the threat model is fully understood.

On-chain analysts circulate larger theft estimates across networks

While Ledger’s reseller investigation unfolded, on-chain researchers took to X to describe suspected theft activity involving wallet addresses across multiple blockchains.

Researcher tanuki42 identified eight wallet addresses that he alleged were linked to more than $72 million in losses. Another investigator, Specter, estimated losses exceeding $86 million across Bitcoin, Ethereum, and Tron, according to their posts on X.

These estimates have not been confirmed independently by Ledger. The extent to which, if any, the alleged on-chain thefts are connected to the CryptoBilis-related issue remains unclear.

Security organization Security Alliance (SEAL) amplified tanuki42’s findings on X, urging users whose funds were transferred to the identified addresses to contact its incident-response team. SEAL did not provide an independent estimate of overall losses and did not identify a cause for the suspected thefts.

Why the distinction between reseller risk and on-chain claims matters

The situation highlights an important asymmetry in crypto incident reporting: Ledger’s current position is narrow and operational, focused on a specific reseller channel and immediate customer safety steps, while on-chain narratives are broader and probabilistic, based on address clustering and flow analysis.

Without confirmation of the incident’s root cause, users should treat the two streams of information as related only if a credible link is established. Ledger has not confirmed either on-chain total, and it has not stated that the alleged address activity originated from the reseller-linked hardware wallets.

Still, Ledger’s guidance is consistent with how hardware wallet compromise scenarios are often mitigated: if funds may have been exposed due to setup or handling, the safest path is to move remaining assets to a new wallet generated in a fresh context (here, using a newly generated recovery phrase).

Investors and traders, meanwhile, should note that these developments are primarily consumer-safety and incident-response focused rather than claims of protocol-level vulnerabilities. The reported uncertainty around totals and causality also underscores why affected users are being advised to take protective action before the investigation concludes.

Readers should watch for updates from Ledger on the investigation findings—particularly any explanation of the suspected failure point in the reseller supply chain—along with any further verification from on-chain analysts or incident-response groups regarding the address-based theft claims.

This article was originally published as Ledger Probes SE Asia Reseller After Reported Fund Losses on Crypto Breaking News – your trusted source for crypto news, Bitcoin news, and blockchain updates.