Ledger Halts CryptoBilis Sales Over $87M in Suspected Stolen Funds
Ledger asked reseller CryptoBilis to pause sales after reports that recent buyers' devices may have been compromised, with on-chain investigators tracking over $86 million in suspected thefts. The hardware wallet maker urged customers who purchased from CryptoBilis in the past 90 days to delay device setup or migrate to a new wallet with a fresh seed.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Ledger's Response to Suspected Compromise
Ledger instructed reseller CryptoBilis to halt sales and advised recent buyers to pause device initialization, according to reports from The Defiant and Decrypt. The directive came after on-chain investigators tracked more than $86 million in suspected thefts linked to devices sold through the reseller, though Ledger has not yet publicly detailed the mechanism of the alleged compromise.
Buyers from the past 90 days were given two options: delay setup entirely or set up their devices with a new seed phrase rather than importing existing wallet credentials. The recommendation to generate a fresh seed suggests the concern is pre-compromise of devices before delivery rather than a flaw in Ledger's firmware after setup.
Investigation Status and Scope
The exact number of affected devices remains unclear. Decrypt cited on-chain investigators tracking $87 million in suspected thefts, while The Defiant reported $86 million, a minor discrepancy that may reflect real-time chain activity or differing time-window analyses. Ledger has not confirmed whether the losses stem from physical tampering, supply-chain interception, or another vector.
Why It Matters
For Traders
If you hold assets moved to a hardware wallet in the past 90 days via CryptoBilis, verify your seed phrase integrity and monitor on-chain activity immediately to detect unauthorized moves.
For Investors
A supply-chain or reseller compromise of this scale—if confirmed—signals a structural vulnerability in the offline-wallet distribution model and may accelerate institutional preference for custodial or self-sovereign solutions.
For Builders
If you operate a hardware wallet or custody layer, assume that resellers and distribution partners represent an attack surface equivalent to your own firmware, and audit your attestation chain accordingly.
This article is for information only and is not financial advice. Read the full disclaimer.
