Secure

Element

Grow

On-chain researchers estimate that somewhere between $72 million and $86 million may have been stolen, as Ledger begins investigating reports of these major crypto losses from users who bought hardware wallets from an authorized Southeast Asian reseller.
The <a href="https://cryptopotato.com/best-hardware-wallets/" rel="noopener noreferrer nofollow">hardware wallet</a> manufacturer said there is no indication that its own infrastructure, systems, or services were compromised. However, users are piling on X to complain about substantial losses.
<h2 id="how-much-was-stolen">How Much Was Stolen?</h2>
The official support channel of Ledger on X <a href="https://x.com/Ledger_Support/status/2108551100613714002" rel="noopener noreferrer nofollow">confirmed</a> yesterday evening that it was investigating user reports from customers of CryptoBilis, which is listed as an authorized reseller in Indonesia, Malaysia, and the Philippines. Ledger asked CryptoBilis to pause all sales and shipments for the time being.
More importantly, the post urged anyone who purchased a device from the reseller in the past 90 days and has not completed installation not to begin setup now. Customers already using such devices were advised to consider transferring their assets to a new Ledger signer using a newly generated seed phrase.
On-chain sleuth tanuki42 <a href="https://x.com/tanuki42_/status/2108527923766399243" rel="noopener noreferrer nofollow">traced</a> more than $72 million to suspected theft addresses, while fellow investigator Specter <a href="https://x.com/SpecterAnalyst/status/2108534068564373687" rel="noopener noreferrer nofollow">estimated</a> losses exceed $86 million, across BTC, ETH, and TRX. Ledger’s official account didn’t confirm either figure, and it remains unclear whether the two estimates include overlapping transactions.
MistTrack noted that the losses could be closer to $90 million, while Tether reportedly froze USDT held in addresses connected with the incident.
<h2 id="what-happened">What Happened?</h2>
The details on what exactly transpired are still scarce, but Binance co-founder Changpeng Zhao <a href="https://x.com/cz_binance/status/2108561409642574285" rel="noopener noreferrer nofollow">said</a> the currently available information suggests a localized supply-chain attack involving one vendor, with a small number of customers potentially receiving counterfeit or physically tampered Ledger devices.
Former Mt. Gox CEO Mark Karpeles <a href="https://x.com/MagicalTux/status/2108651005617607082" rel="noopener noreferrer nofollow">added</a> that he had already been examining modified Ledger devices containing a hidden hardware implant and asked CryptoBilis to open units from its inventory to see whether similar components were present.
He said an implant he examined could monitor internal communications used to display recovery words, potentially allowing an attacker to capture a seed phrase even though the genuine Ledger Secure Element itself remained intact.
Ledger claimed that the reports appear limited to products sold through CryptoBilis and that it has “no indication that Ledger’s security infrastructure, systems, or services have been compromised.”
Meanwhile, users such as Edward Winz have publicly <a href="https://x.com/EdwardTWinz/status/2108605542331523196" rel="noopener noreferrer nofollow">admitted</a> to being victims of the incident, with $1 million reportedly stolen.
The Ledger incident comes just a month after its biggest competitor, Trezor, experienced one of its own, with the personal information of over 80,000 US users <a href="https://cryptopotato.com/trezor-breach-is-much-bigger-than-initially-thought-another-67000-customers-exposed/" rel="noopener noreferrer nofollow">compromised</a>.
The post <a href="https://cryptopotato.com/ledger-investigates-86m-crypto-drain-as-reseller-supply-chain-fears-grow/" rel="noopener noreferrer nofollow">Ledger Investigates $86M Crypto Drain as Reseller Supply-Chain Fears Grow</a> appeared first on <a href="https://cryptopotato.com/" rel="noopener noreferrer nofollow">CryptoPotato</a>.

Ledger Investigates $86M Crypto Drain as Reseller Supply-Chain Fears Grow

Table of Contents

CryptoPotato_News

Other articles published on Oct 10, 2026

Join our free newsletter for daily crypto updates!