Ledger Issues Critical Warning to Customers of Official Reseller: Don’t Set Up Your Device!
Ledger warned customers who bought devices from its official reseller CryptoBilis in the past 90 days not to begin setup, and asked the reseller to halt sales and shipments following reports of lost funds.
The hardware wallet manufacturer is investigating losses reported by customers in Southeast Asia. CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia, and the Philippines; the cause of the losses and the number of affected wallets have yet to be determined.
Who does the warning cover?
The statement Ledger posted from its support account on October 9 was directed at users who purchased products from CryptoBilis in the past 90 days. The company advised customers who have not yet set up their devices not to begin the process.
Those who had already set up their devices were advised to consider moving their assets to another Ledger wallet created with a new recovery phrase. The company said it would provide customers with new information as the investigation progresses.
Estimated losses exceed $86 million
On-chain researcher tanuki42 estimated that more than $72 million in assets had been transferred to suspected theft addresses. Researcher Specter tracked addresses on Bitcoin, Ethereum, and Tron and calculated that potential losses could exceed $86 million.
These amounts have not yet been independently verified. It is also unclear to what extent the two accounts cover the same transactions and addresses. After initially referring to hundreds of victim wallets, Specter said the actual number of affected wallets is not yet known.
CZ raises possibility of a supply chain attack
Binance co-founder Changpeng Zhao (CZ) said the available information could point to a supply chain attack involving a single reseller. According to CZ, some users may have purchased counterfeit or tampered-with devices.
Former Mt. Gox CEO Mark Karpeles also said the reports could be connected to another issue he is working on. As Ledger’s investigation continues, the company is looking into whether the devices were tampered with and how the losses occurred.