Ledger wallets sold by Southeast Asian reseller CryptoBilis linked to reported $86 million crypto theft

Hardware wallet maker Ledger said on Friday 9 October that it is investigating reports of crypto stolen from customers who bought devices through CryptoBilis, a reseller in Southeast Asia, CoinDesk reported. A pseudonymous blockchain investigator, Specter, said on X that more than $86 million (about Rs 2,382 crore at today's dollar rate) may have been drained from hundreds of wallets across Bitcoin, Ethereum and Tron. Neither the amount nor the cause has been confirmed.

What Ledger told customers

Ledger acknowledged the reports but did not confirm the loss figure or say what caused it. As a precaution it asked CryptoBilis to pause all sales and shipments while it investigates, and gave two instructions:

1. If you bought a Ledger from this reseller in the past 90 days and have not set it up, do not start.
2. If you have already activated it, consider moving your coins to a new Ledger with a newly generated recovery phrase.

CoinDesk said there is no confirmed evidence that Ledger's own systems or wallet technology were compromised. One possible explanation is a supply-chain attack: a device tampered with before it reaches the buyer, for example one that comes with a recovery phrase the attacker already knows, so any coins sent to it can be taken.

Why it matters

Ledger, founded in 2014 and based in Paris, says it has sold more than 7 million devices. A hardware wallet keeps the private keys that control your coins offline, which is why people use them instead of leaving money on an exchange. That protection only holds if the device and its recovery phrase are yours alone.

It has been a bad year for crypto security. Last month the exchange Bitget lost more than $350 million in an exploit, and DefiLlama data lists Liquid Network (about $320 million), Drift ($295 million) and Kelp ($293 million) among this year's other large losses.

Bought a hardware wallet in Pakistan? Check this

Whether yours came from an importer, an online shop or a relative abroad, the same rules protect you:

• The recovery phrase must be created by you, on the device, during setup. A wallet that arrives with a phrase printed on a card or already filled in is compromised: do not use it.
• Never type your 24 words into a phone, computer, website or form, and never share them on WhatsApp, however official the message looks.
• Check where it came from. A sealed box from an unknown seller is not proof. If in doubt, reset the device and set it up fresh.
• Move funds only after a fresh setup, and send a small test amount first.

The theft reports did not shake the market much. Bitcoin was near $82,500 on Friday evening, about Rs 2.29 crore a coin: bitcoin price in Pakistan. Ether was near $2,485: ether price. Rupee figures use the interbank rate on our dollar rate page.