Hardware wallet manufacturer Ledger has launched an investigation into lost funds reported by users in Southeast Asia who purchased devices through CryptoBilis, a regional reseller officially listed for Indonesia, Malaysia, and the Philippines. The company requested that the reseller immediately pause all sales and shipments while the review takes place. Ledger has advised anyone who bought a device from this specific reseller within the past 90 days to avoid setting it up. Customers who have already configured their devices are being urged to transfer their digital assets to a newly generated signer utilizing a fresh seed phrase.
Preliminary findings from Ledger indicate that the drained funds are restricted to hardware sold through CryptoBilis, and the company maintains there is no evidence that its core security infrastructure or services have been breached. On-chain analysis from an unverified custom entity tracked by Arkham Intelligence labeled ledger-drainer revealed that roughly $71.5 million remains sitting in flagged addresses. The stolen funds include substantial balances in ether, bitcoin, USDD, and USDT.
Independent scrutiny into the compromised hardware has brought forward alarming hardware-level theories. Former Mt. Gox chief executive Mark Karpelès published details of a separate Malaysian-sourced Ledger device featuring intact shrink wrap that allegedly concealed a secondary board, an LTE module with a data eSIM, and an antenna wired directly into the display casing. According to his analysis, such an implant could theoretically harvest and transmit seed phrases over cellular networks during screen refreshes without triggering firmware warnings. Neither Ledger nor investigators have officially confirmed whether the drained user devices suffered from this exact physical modification.
This incident underscores the inherent vulnerabilities tied to hardware supply chains, even for self-custody cold storage devices designed to remain isolated from the internet. While hardware wallets are widely regarded as the most secure method for holding cryptocurrency, users ultimately rely on the integrity of the supply chain and authorized distribution channels. CryptoBilis operated as an authorized storefront for Ledger alongside other hardware wallet brands, leaving significant questions unanswered regarding how the supply chain interference occurred.
Comments