Ledger has confirmed that every verified case in last week's wallet-draining incident involves devices sold by Southeast Asian reseller CryptoBilis, according to a 72-hour update the Paris-based hardware wallet manufacturer published on Sunday, October 11.

"The volume of impacted devices is limited," Ledger said in the update, adding that its own systems and direct sales channels remain unaffected. The company said it is working with relevant authorities and contacting affected users directly.

How much was stolen, and where did it go?

On-chain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin after Ledger began investigating on Friday. Ledger has not confirmed that figure and has not disclosed what caused the losses.

A second on-chain analysis firm, YFarmX, said it sent Ledger a list of more than 450 drained wallets. According to YFarmX's findings, the thief moved 2,810 ETH through coin mixer Tornado Cash in three separate runs, routed the withdrawals through Zcash's shielded pool, and withdrew approximately 3.28 million USDC into three newly created wallets — funds that Circle, the USDC issuer, retains the ability to freeze.

The laundering chain also involved a swap into a stablecoin outside issuer control, YFarmX said. The thief converted 15 million of the stolen USDT into USDD, a stablecoin Tether cannot freeze, before swapping 5.1 million back into USDT and sending roughly 4.23 million USDT to Binance deposit addresses. Tether froze 10 million USDT on the first day of the incident. YFarmX calculates that 15,475 ETH, 203 BTC and 10 million USDD remain out of reach. The firm's findings have not been independently verified.

Are tampered devices circulating outside Southeast Asia?

An X user posting under the name Johannes has claimed to have found tampered Ledger devices in Europe after buying two units from retail stores. He said both devices carried "identical modifications (such as additional cables and an LTE module)," and called on Ledger to issue a product recall. He said he is sending the second device to Ledger for analysis.

The claims have not been verified, and Ledger's update stated that all confirmed cases so far involve CryptoBilis-sold devices. Decrypt has reached out to Ledger for comment on the European reports.

What is Ledger changing in its reseller controls?

CryptoBilis has confirmed to Ledger that it has ceased all hardware wallet sales, the company said. Ledger is now reminding authorized resellers and distributors to source products only through authorized channels and "never to restock returned products."

The company also warned buyers against unauthorized sellers, where "the risk of buying suspicious, counterfeit or modified devices is important." It said it is reviewing its reseller controls, advancing hardware protections, and inviting other industry players to collaborate on supply-chain and anti-tamper standards.

For affected customers, Ledger repeated its operational guidance:

• CryptoBilis buyers should not set up unused devices.
• Anyone who already initialized a device should move funds to a new seed phrase on a device bought directly from Ledger.
• Ledger "will never call you, DM you, or ask for your 24-word recovery phrase" — a warning aimed at scammers exploiting the incident.

The confirmed link to a single reseller narrows the operational blast radius of the incident, but the roughly $86 million in unverified on-chain losses and the unverified European tampering reports mean the reputational exposure for hardware-wallet distribution channels is not yet contained. Ledger's next disclosures — particularly on the root cause and the outcome of its review of the device Johannes is sending in — will determine whether this stays a reseller-level failure or widens into a broader supply-chain question.