Ledger halts a reseller as wallet drains tied to its devices top an estimated $86 million

A hardware wallet is supposed to be the safe option. Now Ledger is investigating reports that buyers in Southeast Asia lost large sums after buying its devices from CryptoBilis, an official Ledger reseller in Indonesia, Malaysia and the Philippines, The Block reported Friday.

Ledger has asked CryptoBilis to stop all sales and shipments while it investigates. The size of the losses is not confirmed. On-chain researcher tanuki42 said more than $72 million moved to a cluster of suspected theft addresses, and researcher Specter later put the figure above $86 million across Bitcoin, Ethereum and Tron. It is not clear whether the two estimates cover the same transactions.

How it happened is also unknown. Binance co-founder Changpeng Zhao said the information so far points to a supply chain attack involving one vendor, with a small number of buyers possibly receiving fake or tampered devices. Former Mt. Gox chief Mark Karpeles asked affected users to send photos of their devices' circuit boards to check for tampering.

Ledger's advice: anyone who bought from this reseller in the last 90 days should not start setup, and anyone who already set up a device should consider moving assets to a new Ledger with a new seed phrase.

What to watch: Ledger's findings, and whether the devices were tampered with before or after they left the factory.