Ledger Says CryptoBilis Device Impact Is Limited as Suspected Losses Top $100 Million

Ledger says CryptoBilis-linked devices affected only a limited number of users, but investigators have traced more than $100 million in suspected crypto theft across hundreds of wallets.

Ledger said Oct. 11 that every confirmed case involved hardware wallets sold through CryptoBilis, a Southeast Asian reseller. The company has not disclosed the number of affected devices, victims or total losses.

Ledger Support said one affected user’s device contained an unauthorized hardware implant. Ledger has not described the implant’s mechanism or linked it conclusively to all reported drains. The company said its systems and direct sales channels showed no indication of compromise.

Blockchain investigations counted $102 million taken from 324 wallets across six blockchains as of 10 a.m. ET (1400 UTC) Oct. 12. About $82 million remained traceable on-chain at 8:52 a.m. ET (1252 UTC), while Tether froze $10 million in USDT across 20 wallets. Frozen funds cannot move, but the action does not itself return them to victims.

A separate estimate put suspected losses at $103.4 million from 530 addresses across seven blockchains. The difference reflects separate address sets, blockchain coverage and update times.

Ledger advised CryptoBilis buyers not to initialize unused devices. Users who already set them up were told to move assets to a new device using a newly generated recovery phrase.