Ledger has issued security guidance for customers after reports of lost funds, with the central part of the warning aimed at buyers from the past 90 days. The company says a device that has never been set up should remain uninitialized, while users who have already created a wallet may need to move their assets to a new signer using a newly generated recovery phrase.

Key Takeaways

• Ledger is investigating the reported losses and has not disclosed their cause.
• Recent buyers who have not set up their device should avoid starting the process.
• A migration requires a new signer, a new recovery phrase and new receiving addresses.
• Ledger has not confirmed media reports of an $86 million loss total.

The 90-Day Warning Hinges on One Question: Has the Wallet Been Created?

The distinction between an unopened device and an active wallet underpins Ledger's two-part advice. A buyer who has not begun setup has not generated a recovery phrase through that device, and Ledger says such a device should not be initialized. The company's message to users who have already set up a device is more involved, because their wallet may already control assets. That is why the setup question is decisive: control over a wallet follows the recovery phrase rather than the hardware itself, and anyone holding that phrase can recreate the wallet on another device.

For those users, Ledger advised considering a move of funds to a new Ledger signer with a new seed. The company has not publicly described the reason for the precaution, but its wording indicates that replacing the physical device alone would not address the concern.

Device not set up — do not initialize it. Ledger advises buyers from the past 90 days to leave the device unused if setup has not begun.

Wallet already created — use a new signer and seed. Move assets only to addresses created from a newly generated recovery phrase.

Keep purchase records — save the evidence. Keep receipts, order confirmations and device details while the investigation continues.

A Replacement Device Can Still Restore the Old Wallet

A hardware wallet does not hold cryptoassets the way a USB drive holds files. Assets remain on their respective blockchains, while the signer holds the private keys used to authorize transactions.

The 24-word recovery phrase can recreate those keys on another compatible device. Entering the existing phrase into a replacement Ledger therefore restores the same wallet, with the same addresses and the same security history.

Users who choose to move funds should first create a fresh recovery phrase on the new signer, then transfer assets to receiving addresses generated from that phrase. Ledger describes the approach as "move, don't merge". Recovery phrases should never be entered into a computer, phone, website, support chat or online form.

What Ledger's Genuine Check Can Verify

Ledger's Genuine Check verifies the cryptographic identity of the device's Secure Element, the tamper-resistant chip where a Ledger isolates its private keys from the surrounding software. It remains an important authenticity check when a user sets up a Ledger from an authorized source.

The company also says the check cannot establish the full handling history of a device or detect every physical modification surrounding a genuine Secure Element. That limitation helps explain why a product can pass an important authenticity test while the company still investigates a possible problem in the wider sales process. Ledger has published best practices for buying its signer on its official academy page.

The $86 Million Estimate Remains Outside Ledger's Statement

Some crypto media outlets, including Crypto Briefing, have reported claims that losses connected to the incident may exceed $86 million. Ledger has not confirmed that figure, identified the affected wallet addresses, or explained the mechanism behind the reported thefts.

Without those details, outside estimates cannot establish how much of the reported on-chain activity belongs to the investigation Ledger announced.

Confirmed by Ledger:

• It is investigating reports of lost funds.
• It asked the named reseller to pause sales and shipping.
• It issued safety guidance for buyers from the past 90 days.

Still unconfirmed:

• The reported $86 million total.
• The number of affected buyers.
• The cause of the reported losses.
• Any device, firmware or reseller fault.

The Next Ledger Update Needs to Answer Three Questions

Ledger's investigation needs to establish whether the reports share a technical pattern, how buyers can identify affected purchases, and whether customers who have already created wallets need to take action beyond the company's current guidance.

Readers watching for changes to this guidance can check Ledger's official support and academy pages, the same sources carrying the company's current instructions. Until those answers arrive, the company's warning gives recent buyers a practical security boundary: leave an unopened device uninitialized, never share a recovery phrase, and use a fresh seed when moving assets to another signer.

This article is for informational purposes only and does not constitute security, legal or investment advice. Users concerned that their device or recovery phrase may be compromised should follow Ledger's official support guidance.