Ledger Wallets Compromised via Tampered Reseller Units, Triggering $86M Loss as CryptoBilis Disowns Involvement

Ledger, a leading cryptocurrency hardware wallet provider, is working to contain the fallout from a major security breach that drained an estimated $86 million from users’ assets. An investigation traced the problem to CryptoBilis, a Southeast Asian reseller that distributed Ledger devices equipped with malicious firmware implants.

Ledger’s Findings

Investigators discovered that a significant number of Ledger wallets sold through unauthorized resellers in Southeast Asia contained aftermarket firmware modifications. These alterations allowed attackers to bypass the wallets’ standard security checks, leaving users’ funds exposed to theft.

Ledger confirmed the issue on Friday, warning customers against purchasing its products from unofficial resellers because the devices could be cloned or tampered with. While the company did not disclose the precise amount lost, it has launched an audit of its authorized reseller network and supply‑chain protocols.

Ledger has instructed CryptoBilis to cease reselling its hardware while the probe continues and has urged all resellers to avoid restocking returned units. The firm pledged to improve security guidelines, tighten distribution controls, and enhance anti‑tamper mechanisms.

Founder Reveals Change in CryptoBilis’ Ownership This Year

Arravind Prabu, a co‑founder of CryptoBilis, posted on LinkedIn that he no longer owns the platform and was speaking on behalf of his former partner, Vimal Selvamany. Both stepped down in March 2026 after the business was sold to new owners under a confidentiality agreement.

Prabu said the original owners lost all credentials to the platform’s backend systems, customer databases, and communication channels after the transfer. He noted that the deal required a joint announcement in mid‑October 2026 and that his team had notified “all suppliers” of the management restructuring.

Critics Fire Back on Ledger and CryptoBilis

Members of the crypto community praised Prabu for his transparency but questioned whether the new owners actually informed suppliers and clients, given the lack of proof of the communications.

Some observers argued that non‑disclosure agreements do not absolve parties from regulatory obligations or the duty to be transparent with consumers and partners.

Critics also called on Ledger to conduct regular, comprehensive audits of its supply chain, suggesting that such oversight could have prevented the tampered units from reaching users.

Source link