Ledger probes CryptoBilis wallet drains as losses top $86 million

Hardware wallets keep signing keys offline, but reports of drained funds have put one reseller’s distribution channel under scrutiny. Ledger said on Oct. 9 that it is investigating reported losses among Southeast Asian users who bought devices from CryptoBilis.

The investigation matters because Ledger has urged recent buyers to avoid setting up unused devices or move funds to a new signer with a new recovery phrase.

What did Ledger tell CryptoBilis buyers to do?

Ledger asked CryptoBilis to pause sales and shipments while it investigates, according to The Block’s report. Ledger’s support account advised customers who bought from the reseller in the previous 90 days not to set up unused devices. Customers who had already set them up were told to consider moving assets to a new Ledger signer with a new seed phrase.

CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger has not disclosed how many customers may be affected, the value of reported losses or the cause. The company said its infrastructure, systems and services were not compromised, Cointelegraph reported.

How much has been reported stolen?

On-chain researchers have published estimates above $72 million and $86 million, but Ledger has not confirmed either figure. The Block reported that researcher tanuki42 identified suspected theft addresses associated with more than $72 million, while investigator Specter later estimated losses exceeding $86 million across Bitcoin, Ethereum and Tron.

A separate Bitquery investigation counted $92.9 million taken from 311 wallets across five chains—TRON, Bitcoin, Ethereum, BNB Chain and Polygon—by its data cutoff of 16:45 UTC on Oct. 9. Bitquery said the higher total includes activity beyond the ten addresses in the public estimates. These are separate on-chain analyses; the scope of the figures differs, and no total has been confirmed by Ledger.

What do the on-chain records show about the drains?

Bitquery said it traced the first withdrawals on TRON on Oct. 9, followed by activity on Ethereum, BNB Chain, Polygon and Bitcoin. It reported that 13 TRON wallets signed the same token approval before funds began moving, and that the activity then spread across chains within 47 minutes.

Those records trace transactions, not how the attacker obtained access. Bitquery said the chain data cannot establish whether recovery phrases were exposed through devices, the reseller, printed cards, an app or another route. Ledger’s investigation remains ongoing, and the reported loss estimates remain unverified by the company.

Sources

• The Block’s report — theblock.co
• Bitquery investigation — bitquery.io