Hardware wallet manufacturer Ledger is investigating reports of cryptocurrency losses involving devices bought through a Southeast Asian reseller, warning affected customers to consider moving their assets to new wallets while the probe continues.

In a statement posted on X, Ledger said it had asked reseller CryptoBilis to suspend sales and shipments of its devices as a precaution. Customers who purchased devices from the reseller within the past 90 days were advised not to set them up, while those who had already done so were told to consider transferring their assets to a new Ledger signer with a newly generated recovery phrase. Recovery phrases — the word sequences that restore access to a wallet — allow anyone holding them to recreate the wallet elsewhere, which is why the guidance centered on generating a new one rather than keeping the original.

CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines, according to Ledger Support.

Hardware wallets are designed to keep the private keys that control cryptocurrency holdings offline, and their security depends on devices reaching users untampered — one reason the integrity of third-party sales channels has become a focus of the probe.

Ledger has not disclosed how many customers may be affected or the value of the reported losses. The company has also not identified the cause of the incidents or confirmed whether the devices were compromised.

Onchain researchers flag suspected thefts

Separately, onchain researchers reported suspected cryptocurrency thefts involving addresses across several blockchains. Researcher tanuki42 identified eight wallet addresses allegedly linked to more than $72 million in losses, while fellow investigator Specter estimated losses exceeding $86 million across Bitcoin, Ethereum and Tron.

Ledger has not confirmed either estimate, and the extent of any connection to the CryptoBilis investigation remains unclear.

Crypto security organization Security Alliance (SEAL) amplified tanuki42's findings on X, urging anyone whose funds were transferred to the identified addresses to contact its incident-response team. The organization did not provide an independent estimate of losses or identify a cause for the suspected thefts. Because movements on public blockchains leave permanent, traceable records, victim reports and address monitoring are how security teams typically establish the scale and flow of thefts like these.

Ledger says its systems were not compromised

In a statement to Cointelegraph, Ledger said the incident appeared to be isolated to the reseller and the affected market, adding that it had received no reports involving devices purchased directly from the company.

"Ledger's infrastructure, systems and services were not compromised," the company said, adding that its investigation remains ongoing.

Asked whether he had confirmed a connection between the wallet drains and Ledger devices purchased from CryptoBilis, tanuki42 later told Cointelegraph:

Not with certainty, but I'm not aware of a victim report which does not involve this reseller. There are enough victim reports now to be confident that this is not coincidence.

CZ calls for industry-wide recovery efforts

On Friday afternoon, onchain analytics account Onchain Lens reported that wallets allegedly linked to the suspected thefts transferred approximately $270,000 in USDT and TRX to Binance. Most of the funds were subsequently forwarded to a Binance hot wallet, according to the account.

Binance co-founder Changpeng Zhao commented on the incident, suggesting that counterfeit or tampered Ledger devices may have been involved in a supply-chain attack.

"I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds," Zhao wrote on X.

Whether Ledger pinpoints a cause, whether the researchers' loss estimates are borne out, and whether the funds routed to Binance can be recovered remain the key open questions.