From Coinpedia · By Zafar Naik
Ledger is investigating reports of cryptocurrency theft involving customers in Southeast Asia who purchased hardware wallets from reseller CryptoBilis. On-chain investigator Specter has estimated that more than $86 million in crypto assets was drained across 98 wallet addresses, although the total losses and the cause of the incidents have not been independently confirmed.
The reports have raised concerns among Ledger users after affected customers said their crypto holdings were drained. However, a Ledger-wide security exploit has not been confirmed, and the investigation has yet to establish whether a vulnerability in Ledger devices was involved.
Ledger Suspends CryptoBilis Sales During Investigation
Ledger said it had asked CryptoBilis to pause all sales and shipments of its devices as a precaution while the company investigates the reported losses.
The company advised customers who purchased Ledger devices from the reseller within the past 90 days not to initiate setup if they had not already done so.
Customers who have already set up their devices were advised to consider moving their assets to a new Ledger signer using a new recovery seed.
Ledger said it would continue updating customers as the investigation progresses. The company has not confirmed the root cause of the reported incidents.
Crypto Theft Estimates Exceed $86 Million
On-chain investigator Specter shared an estimate of $86.96 million across 98 addresses after examining reports from users who said they owned Ledger devices.
Security researcher tanuki42 had earlier estimated that losses exceeded $72 million and said the amount was increasing.
The reported thefts involve assets across Bitcoin, Ethereum and Tron networks. However, the 98 addresses identified by Specter do not necessarily represent 98 confirmed victims, and the estimates have not established the full scale of the incidents.
It also remains unclear whether the affected wallets were compromised through stolen recovery credentials, a reseller-related issue or another attack method.
How Crypto Can Be Stolen Without Access to a Ledger Device
A hardware wallet protects private keys by keeping them secured within the device. However, a wallet’s recovery phrase can be used to restore access to its funds on another compatible wallet.
If an attacker obtains the complete 24-word recovery phrase, they may be able to recreate the wallet’s keys and transfer its assets without physically accessing the original Ledger device.
An additional passphrase, when configured, provides another layer of protection. Anyone attempting to access a wallet protected by one would also need the correct passphrase.