Ledger Pauses CryptoBilis Sales After $86M Drain Claims

Ledger has asked a Southeast Asian reseller to stop selling its hardware wallets while it investigates reports that buyers lost funds, about an hour after on-chain investigators put suspected losses above $86 million.

The advice for a holder is narrow. If you bought a Ledger from that reseller in the last 90 days and have not set the device up yet, Ledger says do not start setup. If you already set it up, Ledger says consider moving your assets to a new Ledger signer with a new seed.

What Ledger Actually Said

Ledger Support named the seller as CryptoBilis, a Malaysian shop founded in 2020 that also sells in Indonesia and the Philippines. In its own words:

As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.

Sources disagree on the spelling, with one account using CryptoBillis, so the name may appear either way elsewhere. The reseller has not responded in anything read for this article, and its site could not be opened.

That Ledger post carries no numbers. It does not mention the $86 million tally or any of the addresses circulating in the on-chain posts. It does not say how many users or how much money is involved. Ledger has not endorsed the $86 million total, and it has not explained how funds left users' wallets.

The $86 Million Figure Belongs to an Analyst

Specter said on X on October 9 that a trace of theft addresses shows losses of more than $86 million from reported drains of Ledger users' wallets. Specter said those addresses took in funds from hundreds of victims' wallets on multiple major chains, naming Ethereum, TRON and Bitcoin.

The same post listed 10 addresses, and those addresses held only a little over $25 million at last check, which suggests most of the money had already been moved.

An earlier post by tanuki42, published at 12:00 UTC, put the total at over $72 million and said it was increasing, listing eight addresses that all also appear in Specter's list of 10. Specter's list, posted at 12:24 UTC, added two more bitcoin addresses. The Security Alliance quote-posted tanuki42's list at 12:29 UTC and asked anyone drained to contact SEAL 911 through its Telegram bot.

The two totals differ because the lists differ: Specter's is later and wider, with two extra Bitcoin addresses. Neither number comes from Ledger. Some reports suggest the final figure could approach $100 million once more victims are identified, but that is a report, not a confirmed total.

Nobody Has Said How the Funds Left

None of the three posts about the theft addresses say how the funds were taken, or whether the cause was hardware, software, phishing or something else. Ledger has not explained it either.

CryptoBriefing listed three explanations circulating on X and Reddit: a vulnerability in Ledger's hardware or firmware, compromised seed phrases, or phishing. Whether any CryptoBilis device was physically tampered with is not something Ledger has said, and no source read states it.

211 BTC Have Not Moved

Public mempool records showed three of the Bitcoin addresses Specter listed holding about 211 BTC combined, none of it moved as of 13:44 UTC on Friday. One of them, bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, was flagged as the address to watch, reported to have taken in over 211 BTC and left untouched as of the report. No page read gives a Bitcoin price, so no dollar value is attached to that figure here.

Fake Devices and Fake Apps Have Done This Before

This is not the first report of Ledger users losing funds through something other than a lost seed phrase.

• In April, a researcher found fake Ledger units on a Chinese marketplace that sent PINs and seed phrases to attackers.
• Earlier this year, a fake Ledger Live app on the Apple App Store drained about $9.5 million from more than 50 users before it was caught.
• In August, a Coldcard firmware bug drain cost Bitcoin holders about $70 million, though sources give different totals for that one.

CoinLaw said the pattern in the flagged funds fits a coordinated campaign hitting many holders at once, rather than a few unlucky individuals.

What Would Change This Story

Two things would move it forward: Ledger naming a cause, or the untouched Bitcoin moving. Until then, the only confirmed action is the pause on CryptoBilis sales, and the only confirmed advice is for recent buyers from that shop to treat their setup as suspect.