Ledger, the prominent hardware wallet manufacturer, is currently investigating alarming reports of a significant crypto theft totaling between $72 million and $86 million. The alleged theft is connected to devices sold by the Southeast Asian reseller, CryptoBilis. This incident has raised serious concerns among users and the broader crypto community.
Since its inception in 2014, Ledger has successfully sold over 7 million devices globally, establishing itself as a trusted name in crypto security. However, the recent claims have prompted the company to take immediate action by asking CryptoBilis to halt all sales and shipments during the ongoing investigation.
Pseudonymous researchers have pointed to the possibility that hundreds of wallets may have been compromised. One researcher, Specter, indicated that the losses could exceed $86 million, while another, known as tanuki42, has traced eight wallet addresses linked to over $72 million in losses. Both researchers have indicated that the affected wallets span major blockchains, including Bitcoin, Ethereum, and TRON.
Neither Ledger nor its infrastructure appears to have been compromised, as the company reassured its users. The exact number of affected customers and the specifics surrounding the cause of these losses remain unclear. Ledger has advised customers who purchased devices from CryptoBilis within the last 90 days not to set them up. Those who activated their wallets are recommended to transfer their funds to a new Ledger device with a newly generated recovery phrase.
Ledger emphasized that the situation seems to be confined to the reseller and its markets, stating, “Ledger’s infrastructure, systems, and services were not compromised.” The company has not confirmed any specific details regarding how the theft occurred but has left the door open for various possibilities, including a supply chain attack where a device could be tampered with before reaching the buyer.
In response to the situation, the Crypto security group, Security Alliance, has echoed the findings of tanuki42 and urged anyone who may have transferred funds to the flagged addresses to reach out to their incident response team. However, they have not released their own loss estimates or confirmed the cause of the incident.
Recent reports indicated that wallets associated with the suspected theft managed to move approximately $270,000 in USDT and TRX to Binance, with a significant portion being directed to a Binance hot wallet. Binance co-founder Changpeng Zhao has called for collaborative efforts within the industry to trace and recover the stolen funds, acknowledging the potential involvement of counterfeit or tampered Ledger devices in this incident.
This unfortunate event contributes to a challenging landscape for crypto security this year, which has already witnessed other substantial exploits, including a Bitget hack exceeding $350 million and a Liquid Network loss of nearly $320 million. As the investigation unfolds, Ledger has assured the public that it will continue to provide updates regarding the situation.
For now, the full extent of the loss, the number of victims, and the definitive cause of this alarming theft remain unconfirmed. The community watches closely as Ledger works to resolve this serious issue.
