Ledger Hack: $86.9 Million Reportedly Drained Across 98 Wallet Addresses

Ledger is investigating reports of cryptocurrency theft involving customers in Southeast Asia who purchased hardware wallets from reseller CryptoBilis. On-chain investigator Specter has estimated that more than $86 million in crypto assets was drained across 98 wallet addresses, although the total losses and the cause of the incidents have not been independently confirmed.

The reports have raised concerns among Ledger users after affected customers said their crypto holdings were drained. However, a Ledger-wide security exploit has not been confirmed, and the investigation has yet to establish whether a vulnerability in Ledger devices was involved.

Ledger Suspends CryptoBilis Sales During Investigation

Ledger said it had asked CryptoBilis to pause all sales and shipments of its devices as a precaution while the company investigates the reported losses.

The company advised customers who purchased Ledger devices from the reseller within the past 90 days not to initiate setup if they had not already done so.

Customers who have already set up their devices were advised to consider moving their assets to a new Ledger signer using a new recovery seed.

Ledger said it would continue updating customers as the investigation progresses. The company has not confirmed the root cause of the reported incidents.

Crypto Theft Estimates Exceed $86 Million

On-chain investigator Specter shared an estimate of $86.96 million across 98 addresses after examining reports from users who said they owned Ledger devices.

Security researcher tanuki42 had earlier estimated that losses exceeded $72 million and said the amount was increasing.

The reported thefts involve assets across Bitcoin, Ethereum and Tron networks. However, the 98 addresses identified by Specter do not necessarily represent 98 confirmed victims, and the estimates have not established the full scale of the incidents.

It also remains unclear whether the affected wallets were compromised through stolen recovery credentials, a reseller-related issue or another attack method.

How Crypto Can Be Stolen Without Access to a Ledger Device

A hardware wallet protects private keys by keeping them secured within the device. However, a wallet’s recovery phrase can be used to restore access to its funds on another compatible wallet.

If an attacker obtains the complete 24-word recovery phrase, they may be able to recreate the wallet’s keys and transfer its assets without physically accessing the original Ledger device.

An additional passphrase, when configured, provides another layer of protection. Anyone attempting to access a wallet protected by one would also need the correct passphrase.

This is one possible explanation for how crypto can be transferred without the original hardware wallet approving the transaction. However, it does not establish how the reported thefts occurred.

Ledger Users Warned Against Sharing Recovery Phrases

Users should never enter their recovery phrases on websites, mobile apps or support chats claiming to secure their wallets. Ledger has repeatedly warned users that it will never ask them to disclose their recovery phrases.

Customers who purchased devices from CryptoBilis within the past 90 days should follow Ledger’s specific guidance and avoid setting up unused devices until further information is available.

Users who suspect their wallets have been compromised should avoid sharing recovery credentials and use a trusted, secure device setup when transferring remaining assets to a newly generated wallet.

The investigation remains ongoing. Until Ledger confirms the cause, the reported losses should not be treated as proof of a company-wide hardware wallet exploit.