Users of Ledger wallets in Southeast Asia have reported losses exceeding $86 million linked to a reseller named CryptoBilis. Investigators, including crypto analysts Specter and Tanuki42, identified a significant number of victims and traced the theft to numerous addresses across major blockchains such as Ethereum, TRON, and Bitcoin.
In response to these reports, Ledger confirmed it is looking into the issue and has instructed CryptoBilis to halt all sales and shipments of its devices. The company is alerting users who purchased wallets from CryptoBilis in the last 90 days to avoid setting up their devices. If they have already done so, they are advised to transfer their assets to a safe Ledger signer.
CryptoBilis presents itself as a trusted Web3 brand, claiming to be an authorized reseller of Ledger products in Malaysia alongside other hardware wallets. However, the recent developments have raised concerns about the integrity of the devices sold by the reseller.
Mark Karpelès, former CEO of Mt. Gox, pointed out that tampered Ledger wallets sold by various resellers have been found with spyware capable of stealing users’ passkeys. Ledger has stated that it will continue updating customers as the investigation unfolds.
Security experts are cautioning against the rising panic associated with these wallet-draining incidents. Researcher Taylor Monahan has warned that spreading reports of these issues could lead users to mistakenly believe there is a fundamental vulnerability in Ledger wallets when there may not be one. She emphasized the importance of vigilance against phishing attempts and misleading online advertisements that could exploit user anxiety during this situation.
Additionally, Ethereum researcher Justin Drake recently advised crypto holders to adopt a more cautious approach and secure their assets amid concerns over potential vulnerabilities in cryptographic protocols. Monahan critiqued Drake’s alarmist approach, suggesting it could inadvertently fuel user panic and lead to increased susceptibility to scams.
As Ledger continues its investigation and communicates with affected users, further updates are anticipated regarding the situation and the fate of CryptoBilis. The company has refrained from providing further comments beyond its initial statement.
