Ledger has suspended sales by Malaysian reseller CryptoBilis and opened an investigation after on-chain analyst Specter linked more than $86 million in suspected losses to wallet-draining incidents reported by Ledger users on X and Reddit.

The hardware wallet maker disclosed the probe in an Oct. 9 statement, saying it is looking into reports of fund losses from customers in Southeast Asia who purchased devices through CryptoBilis.

"Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis," the company said. "As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices."

How large are the suspected losses?

Specter, the on-chain analyst whose findings preceded Ledger's statement, put the figure at over $86 million in suspected losses tied to wallet-draining incidents that users reported on social platforms. An analysis of the theft addresses showed funds flowing in from hundreds of victim wallets, spanning Ethereum, TRON, Bitcoin and other major blockchains.

The multi-chain footprint matters operationally. Drainage across Ethereum and TRON typically points to compromised seed phrases or pre-tampered device setup rather than a protocol-level exploit, since the attacker must obtain signing authority over each victim's assets individually.

What should affected customers do now?

Ledger has issued two distinct instructions depending on purchase status. Customers who bought devices from CryptoBilis within the last 90 days and have not yet initialized them should not begin device setup at all.

Customers who have already completed setup should migrate: the company urged them to transfer assets to a new Ledger signer generated with a fresh seed phrase. That step isolates funds from any potentially compromised recovery phrase and restores exclusive control of the private keys.

Ledger said it would provide further updates as the investigation progresses. The company has not yet specified how many devices sold through the reseller fall within the exposure window, nor whether it has confirmed tampering in the supply chain.

What does this mean for hardware wallet distribution?

The case underscores the structural weakness in third-party reseller channels for self-custody hardware. Unlike software wallets, a hardware device passes through physical custody before reaching the buyer, and a compromised intermediary can substitute or pre-configure devices without the manufacturer's knowledge.

For Ledger, the operational consequences are immediate: a distribution partner frozen across a regional market, a growing liability question over reimbursable losses, and renewed pressure to verify the integrity of every unit sold outside its direct channel. For the industry, the incident is likely to accelerate the shift toward manufacturer-direct sales and sealed-chain-of-custody verification for hardware wallets sold in secondary retail markets.

Ledger has not announced a compensation mechanism. The investigation window it has set — purchases within the last 90 days — offers the clearest near-term benchmark for judging how far the exposure extends.