- Ledger has asked CryptoBilis, a reseller listed on its own site for Malaysia, Indonesia and the Philippines, to pause sales and shipments while it investigates reports of customers losing funds.
- investigators put the suspected total close to $90m. Tether has frozen some of the USDT involved.
- Nothing reported so far points to a fault in Ledger’s hardware. The suspicion sits with how these particular devices reached buyers.
Buying a hardware wallet from a shop that appears on the manufacturer’s own list of approved sellers is meant to be the careful option. A number of people in Southeast Asia did that, and their coins were moved out shortly after they set the devices up. Investigators now put the suspected total near $90m.
A hardware wallet only protects you if the device is the only thing that has ever known your . If it arrives already knowing it, the protection is gone before the first transaction, and nothing you do afterwards undoes that. That is why the advice in this case is to move the money to a different device rather than reset the one you have.
It also changes what “buy from a trusted seller” is worth. The reseller here was on the trusted list.
What a hardware wallet is doing for you
Your crypto never sits inside the device. It sits on the blockchain, a public ledger anyone can read. What you actually own is a , and behind that key is a recovery phrase: usually 12 or 24 ordinary English words that can rebuild the wallet on any compatible device anywhere in the world.
The hardware wallet’s job is to generate that phrase itself, offline, show it to you once so you can write it down, and then never let it reach a computer. Whoever has the phrase has the coins, with no bank to ring and no reset.
So the whole arrangement rests on a single assumption, which is that nobody but you has ever seen those words. A device that arrives pre-initialised, or with a card in the box listing a phrase for you to “use”, breaks that at the point of sale. The buyer then funds a wallet somebody else can empty at a time of their choosing, which is often weeks later.
Ledger has not said what it has found. Its statement, published on 9 October, says it is investigating reports from customers who bought through CryptoBilis, that it asked the distributor to stop selling and shipping as a precaution, and that anyone who bought in the past 90 days should not initialise a device they have not yet set up. Customers who have already set one up were told to consider moving their holdings to a new Ledger with a fresh recovery phrase.
A hack of the company, or a problem with one shop
“Ledger hack” is appearing in a lot of headlines, including the one on the write-up this article is based on, and it carries more than the facts do. There is nothing so far to suggest Ledger’s chips, firmware or key generation failed. The reports concern devices sold through one channel.
That distinction matters because the two failures need different responses. When a device itself generates weak keys, as happened with the Coldcard losses we covered recently, every owner of an affected unit is exposed no matter where they bought it. When a distribution channel is compromised, the exposure is limited to what passed through it, which is why Ledger’s advice is framed around a 90-day window and one seller.
It does not let the company off. A manufacturer that publishes a directory of approved resellers is making a recommendation, and buyers reasonably treat that list as a safety check rather than a convenience. If a name on it turns out to be the common factor, the programme is part of the story even if the hardware is sound.
One thing we cannot resolve: the roughly $90m figure sits very close to the total attributed to the Coldcard key-generation thefts a few weeks ago. That may be coincidence, or the same pool may be getting counted twice by different trackers. We flag it as our own inference, not a finding.
What Tether’s freeze actually does
USDT is a issued by Tether, and because the company controls the contract it can blacklist an address, which stops the at that address from moving at all. That is a real power and most assets do not have an equivalent.
What it is not is a refund. Frozen tokens sit where they are. Getting them back to the people they came from normally needs a court process, an identified claimant and a cooperative exchange, and that can take a long time or go nowhere. The freeze also only covers USDT. Any bitcoin, ether or other asset in the stolen total has no switch anyone can throw.
If you have bought a hardware wallet recently
Buy direct from the manufacturer’s own website rather than a marketplace listing or a third-party shop, and accept the slower delivery. A genuine device asks you to write down a recovery phrase that it generates in front of you during setup. If a phrase arrives with the device, printed, stickered or on a card, the device is not safe to use, and the people who have been caught by this pattern previously had no obvious reason to think otherwise.
If you are moving funds off a device you are unsure about, set up the replacement first, write down its new phrase, and send the coins to addresses from the new wallet. Reusing the old phrase on new hardware achieves nothing. Our comparison of Trezor and Ledger covers how both handle first-time setup.
What to watch
Whether Ledger publishes what it found, and specifically whether any affected stock reached buyers outside the three countries named. Until that lands, nobody outside the investigation can tell how wide the window is.
Then the number. Estimates in the first days of an incident are usually assembled from wallet clustering and tend to be revised in both directions. And whether Tether’s freeze produces anything beyond stopped tokens, because that is the part affected holders will care about and the part that historically takes longest.
We have not seen Ledger’s statement in full or the investigators’ underlying work, only a secondary account of both, so treat the detail here as provisional.