Ledger, a prominent French manufacturer of cryptocurrency hardware wallets, announced that it has traced the recent large-scale crypto theft to devices purchased from CryptoBilis, a licensed reseller operating in Southeast Asia.
Reseller-linked devices under scrutiny
In its statement released on October 11, Ledger reported that only wallets bought through CryptoBilis appear to be affected by the theft discovered on October 9. The company did not specify the exact number of compromised wallets but described the scope as limited.
Ledger stated that the security incident has not impacted its own infrastructure or devices sold directly by the company.
The firm assured customers that its systems and direct distribution channels remain secure, distancing the incident from its internal operations.
Investigation and estimated losses
Ledger is actively cooperating with law enforcement and regulatory bodies to uncover the method behind the theft. Company representatives are also contacting impacted customers to address their losses and provide assistance.
Blockchain analysts report that more than $86 million in digital assets may have been stolen using the compromised hardware. However, these figures are yet to be conclusively verified.
The company noted that ongoing investigations have revealed several worrisome details, deepening concerns about supply chain vulnerabilities within the hardware wallet sector.
Hardware implants and tampering fears
Ledger previously disclosed that it found an unauthorized hardware implant on a wallet used by one of the affected customers. This discovery raised suspicions that certain devices may have been altered before delivery.
Investigators continue to examine whether all reported thefts stem from similar modifications or if different methods were involved in each breach.
CryptoBilis, which serves as a key distributor for Ledger products in Southeast Asia, has temporarily suspended all sales of hardware wallets following the revelations.
Mini dictionary: CryptoBilis, a regional authorized reseller known for providing crypto hardware wallets primarily in Southeast Asia; authorized resellers distribute products under agreements with the manufacturer, and supply chain integrity is especially critical for hardware security devices.
Strengthened security and industry-wide call
In response to the breach, Ledger has tightened supply chain controls. The firm has enhanced its reseller verification process and upgraded its hardware designs to better prevent unauthorized physical modifications.
Ledger has urged its distributors to source wallets exclusively from official channels and discourages the resale of returned devices to minimize risk. The company reiterated the importance of strict adherence to these protocols to safeguard customer funds.
Acknowledging the broader implications, Ledger emphasized that the risks uncovered are not exclusive to its own products. The company called on other wallet manufacturers and cyber-security experts to collectively improve defenses across the hardware wallet sector in light of increasingly sophisticated tampering attacks.
