Ledger, the Paris-based hardware wallet maker, has opened an investigation into the theft of roughly $86 million in cryptocurrency from hardware wallets sold through CryptoBilis, a Malaysian store listed on Ledger's official reseller directory.

The case stands out because hardware wallets are built to keep private keys offline, a security model that depends on a device arriving untampered — and Ledger's standard safety guidance urges customers to buy only through vetted, official channels. CryptoBilis was vetted by Ledger itself.

The suspected theft

CryptoBilis is a Malaysian online store launched in December 2020 by Arravind Prabu, Vimal Selvamany and Dhivager Rathakrishnan under their company, Fetch International, according to Vulcan Post. The store announced in 2021 that it had become an authorized reseller for Ledger.

On Friday, Ledger said in a post from its support account on X that it had asked CryptoBilis to halt all sales and shipments of Ledger products while it investigates reports that more than $86 million in Bitcoin, Ethereum and Tron was stolen from wallets the store sold.

Specter, a pseudonymous blockchain investigator, posted on X that complaints of drained wallets had surfaced across X and Reddit among Ledger owners. Specter said their review of the suspected theft addresses found deposits arriving from hundreds of victim wallets on Bitcoin, Ethereum and Tron, adding up to more than $86 million.

The total amount lost has not been confirmed, nor has any connection between the individual cases. The cause remains unknown. Ledger says there is no evidence that its own systems or wallet software were breached. Those open questions — how the devices were compromised, how large the confirmed loss ultimately is, and whether the individual cases are connected — frame what to watch as the investigation proceeds.

Ledger's advice to customers

Ledger advised anyone who purchased from the reseller within the past 90 days not to set up their device yet. Customers who had already activated a wallet were told to move their funds to a different Ledger device using a newly generated recovery phrase. The instruction to generate a new phrase matters because a recovery phrase acts as the master key to a wallet — if it was compromised before the device reached its owner, moving funds to a wallet that reuses the old phrase would leave the balance exposed.

Supply-chain attack theory

One leading theory for how the attackers operated is a supply-chain attack. In such an attack, a device is tampered with so that its recovery phrase is already known to an attacker before it reaches the buyer, allowing the wallet to be drained once funds arrive.

The method was documented in 2023, when Kaspersky researchers examined a tampered Trezor Model T hardware wallet. The device's main chip had been replaced, and its software was rigged to give users one of 20 recovery phrases already known to the attackers. In that case, the attackers waited about a month before emptying the wallet.

A difficult stretch for Ledger

Cryptopolitan reported in May that Ledger had abandoned a planned $4 billion U.S. initial public offering, citing poor market conditions. The company said it was weighing private fundraising instead, though the chances of that route now appear slimmer following the fresh security scare.

In January, Ledger disclosed a separate incident in which its payment processor, Global-e, experienced a customer-data leak. Blockchain investigator ZachXBT commented at the time that hardware wallet firms cannot be trusted with personal information.