Ledger is investigating reports that more than $86 million in cryptocurrency may have been drained from wallets shipped through CryptoBilis, a Southeast Asian reseller, the Paris-based hardware wallet maker said Friday.

Pseudonymous blockchain investigator Specter wrote on X that more than $86 million in crypto may have been stolen from "hundreds of wallets," with suspected theft addresses traced across Bitcoin, Ethereum and Tron after complaints surfaced on X and Reddit. There has been no independent confirmation of the loss figure.

What has Ledger confirmed?

Ledger acknowledged the user reports and identified CryptoBilis as the reseller at the center of the complaints, but stopped short of validating the $86 million tally or naming a cause. "We are investigating the reports and will update as we learn more," the company said, urging customers who purchased devices from CryptoBilis within the past 90 days not to begin setting them up.

What is Ledger telling customers to do?

The company asked CryptoBilis to halt all sales and shipments during the probe. Customers who already activated a device bought through the reseller should consider moving assets to a new Ledger unit generated from a fresh recovery phrase, according to Ledger's guidance. Specter, the on-chain investigator, said affected users reported assets vanishing despite following standard setup procedures.

Could this be a supply-chain attack?

A supply-chain compromise is one working theory. In that scenario, an attacker interferes with a device before it reaches the buyer, preloads a known recovery phrase and waits for the user to deposit funds. Ledger emphasized that there is no current evidence that its own firmware, manufacturing or backend systems were breached, and said the issue, if real, appears confined to a third-party distribution channel.

How big is this relative to other 2025 losses?

If confirmed at $86 million, the incident would rank among this year's larger crypto security events, though still below several recent exchange and protocol exploits:

• Bitget: more than $350 million stolen in September
• Liquid Network: roughly $320 million
• Drift: about $295 million
• Kelp: approximately $293 million

DefiLlama compiled the figures. The cumulative toll has made 2025 one of the heaviest years on record for crypto theft.

What remains unverified?

Three variables will determine whether the incident becomes a watershed supply-chain case or a cluster of unrelated drains:

• The total loss figure and number of affected wallets
• Whether the Bitcoin, Ethereum and Tron incidents share a common origin
• Whether any device shipped by CryptoBilis was physically tampered with

Ledger said it will publish further updates once its internal review advances. Customers holding balances on suspect devices have no recourse from Ledger's hardware until the investigation clarifies the vector, and the 90-day purchase window limits the pool of at-risk users but does not exclude earlier buyers from further findings.

Founded in 2014, Ledger says it has sold more than 7 million hardware wallets worldwide, a footprint that magnifies the operational stakes of any confirmed compromise tied to its distribution chain.