Ledger is investigating thefts affecting customers who bought hardware wallets through the reseller CryptoBilis in Southeast Asia, and has asked to pause sales and shipments.

Scope of the investigation

Researchers estimate that the incident may have impacted hundreds of wallets, and the total losses reported exceed $86 million, according to public statements and community reporting.

Suspected device tampering

One hypothesis under review is that devices were modified before sale, allowing attackers to intercept recovery material during setup and later drain balances.

Former Mt. Gox chief Mark Karpelès reported finding a concealed module that allegedly captures the seed phrase during device initialization, a discovery cited by investigators as part of the inquiry.

Guidance for recent buyers

Ledger has advised purchasers who received devices from CryptoBilis within the past 90 days to refrain from initializing those wallets until the investigation concludes.

For users who already set up devices, the company recommends considering transferring funds to a new hardware wallet generated with a new seed phrase to mitigate ongoing risk.

Next steps and vendor response

The vendor was asked to suspend sales and shipments while Ledger and independent researchers continue forensic analysis, and stakeholders in the community are monitoring further disclosures.