On-chain analysis traced a coordinated drain of funds from Ledger hardware wallets across Ethereum, TRON and Bitcoin, with cumulative losses reported at over $86 million and some estimates suggesting the figure could approach $100 million. Analyst Specter identified theft addresses that aggregated inflows from hundreds of victim wallets and flagged a Bitcoin address (bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl) holding roughly 211 BTC that had not moved at the time of reporting.
Ledger had not publicly commented. Community theories include device or firmware flaws, compromised seed phrases, and phishing that tricks users into signing malicious transactions. The Defiant urged buyers from the past 90 days to delay device setup or consider moving assets to a new Ledger with a new seed. Prior related incidents—an earlier fake Ledger Live drain of about $9.5 million, a Zilliqa Ledger app flaw, and a Coldcard seed-generation issue tied to roughly $88 million lost—frame the current incident while the exact attack vector remains unconfirmed.
Reseller sales paused
Ledger has publicly identified the Southeast Asian reseller at the center of the developing case and asked that seller to halt all sales and shipments while investigators look into reported losses. Reports name the shop as CryptoBilis — with at least one outlet using the variant spelling “CryptoBillis” — and describe it as a Malaysia-based merchant founded in 2020 that also operates in Indonesia and the Philippines. Independent on-chain sleuths, including Specter and tanuki42, continue to track more than $86 million drained across Ethereum, TRON and Bitcoin and note roughly 211 BTC sitting in the Bitcoin addresses they flagged that had not moved at the reported timestamp. Ledger has not endorsed the total loss figure or said that devices were tampered with; instead the company’s guidance to purchasers from that reseller in the past 90 days is precautionary: do not initialize devices you haven’t set up, and move funds to a new Ledger with a fresh seed if you already initialized one. The new items add concrete reseller naming, regional scope and the formal pause request to the evolving picture, while the investigation and official confirmation of a root cause remain outstanding.