ذرائع کی جانچ پر مبنی تحقیق: OKX

What Ledger has actually said

Ledger's official support account posted its statement at 13:32 UTC on 9 October. It makes four points, and nothing more:

• Ledger is investigating reports of loss of funds from users in Southeast Asia who purchased products from a reseller named CryptoBilis.
• As a precaution, and pending the investigation, Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices.
• Anyone who bought from this reseller in the last 90 days and has not set the device up should not start the setup.
• Anyone who has already set it up should consider moving assets to a new Ledger signer with a new seed (recovery phrase).

In a separate statement quoted by Cointelegraph, Ledger said the incident appeared to be isolated to the reseller and the affected market, that it had received no reports involving devices bought directly from Ledger, and that "Ledger's infrastructure, systems and services were not compromised." The most recent Ledger statement we could read at publication is that 9 October post; it promised further updates as the investigation progresses.

Ledger's own reseller directory, which we checked on 11 October, still lists CryptoBilis under Indonesia and Malaysia (cryptobilis.com) and CryptoBilis PH under the Philippines. The listing shows the reseller was an official channel, which is why the case matters to anyone who thought "authorized reseller" meant "safe by default".

The numbers, and who produced them

An earlier Onchain Lens post, quoted in that update, said the attacker had sent 430.2 ETH (about $1.07 million) into Tornado Cash through four wallets, had been converting USDT into USDD after Tether froze some funds, and that wallets tracked by Arkham still held about $70.6 million: 11,406 ETH, 213.371 BTC, 13.646 million USDD and 10.909 million USDT.

None of these figures has been confirmed by Ledger. CoinDesk noted there had been no independent confirmation of the total, and Cointelegraph reported that the connection between the drained addresses and CryptoBilis devices was still unclear. Treat $72–86 million as investigators' estimates of what flowed into suspected theft addresses, not as an audited loss.

The likely mechanism, and why it is not yet proven

Binance co-founder Changpeng Zhao wrote that the incident looked like "a supply chain attack with one vendor" in which a small number of people bought fake or tampered devices. CoinDesk described the same possibility: a device that reaches the buyer with a recovery phrase the attacker already knows. The victim then deposits funds, and the attacker, holding the same phrase, empties the wallet later.

That scenario matters because it is different from a flaw in Ledger's chips or software. A hardware wallet is only as private as its recovery phrase. If someone else generated or saw that phrase before you, the device's secure element cannot protect you. Ledger's support account repeats the corollary on its profile: Ledger will never ask for your 24-word recovery phrase, and never DMs or calls users.

Neither Ledger nor any investigator has confirmed tampering or pre-generated phrases as the cause. The supply-chain explanation fits the reseller pattern, but until Ledger publishes findings it remains a hypothesis.

What to do now, by situation

You bought from CryptoBilis in the last 90 days and have not set the device up. Follow Ledger's instruction: do not start setup. Contact Ledger customer support through support.ledger.com, not through links sent to you by message.

You bought from CryptoBilis and the device is in use. Ledger's advice is to consider moving assets to a new Ledger device with a newly generated recovery phrase. Move the coins to an address created by a device you obtained through a channel you trust, and do it soon rather than after the investigation closes.

You found your funds drained to one of the published addresses. SEAL asked victims to contact its SEAL 911 team. Keep transaction hashes, the purchase receipt and the device itself.

You bought elsewhere. Ledger says it has no reports involving devices bought directly from Ledger. The general rule still applies: if a device ever arrives with a recovery phrase already printed, filled in or "pre-set", do not use it.

What to watch next

• Whether Ledger confirms a cause, a loss figure and a count of affected customers.
• Whether CryptoBilis stays in Ledger's reseller directory or is removed.
• Freezes: Onchain Lens reported Tether had frozen some funds and flagged deposits to Binance; further freezes would limit how much the attacker can cash out.
• Copycat phishing. Incidents like this are followed by fake "Ledger support" messages offering to "secure" your funds. Ledger does not ask for recovery phrases.

How to act on this

If you are moving funds off a device you no longer trust and the replacement has not arrived, some users park coins briefly on an exchange they already use. That swaps device risk for custodial risk, so keep it short, turn on two-factor authentication and an anti-phishing code, and withdraw to the new device once it is set up. For market stress after security news, check liquidations and current venue campaigns on /activities.

Quick answers

Was Ledger hacked? Ledger says its infrastructure, systems and services were not compromised and that the reports involve devices bought from one reseller. The cause has not been confirmed.

How much was stolen? Investigators estimate more than $72 million (tanuki42) to more than $86 million (Specter). Ledger has not confirmed a figure.

Which countries are affected? Ledger's statement refers to users in Southeast Asia. Its reseller directory lists CryptoBilis for Indonesia, Malaysia and the Philippines.

I bought my Ledger directly from Ledger. Should I worry? Ledger says it has received no reports involving devices bought directly from the company. Never use a recovery phrase you did not generate yourself.

Will victims be reimbursed? Ledger has not said. We found no compensation statement in the sources we could read.

Limits of this article

Loss estimates come from independent onchain investigators and analytics accounts, not from Ledger. Fund-flow figures are as of 9 October and may have changed. We have not verified the number of affected customers, the cause of the drains or whether any funds were recovered. This article reports a developing security incident; it is not security, legal or investment advice. Partner links may earn NexuAlpha a commission paid by the exchange, at no extra cost to you.