Ledger Probes CryptoBilis Wallet Losses as On-Chain Count Reaches $92.9M

Ledger is investigating reports of lost funds from users in Southeast Asia who purchased devices through CryptoBilis. The hardware-wallet maker said it asked the reseller to pause sales and shipments while the investigation continues. It advised recent buyers not to initialize unused devices and told users who already set one up to consider moving assets to a new signer created with a new recovery phrase. Readers can follow confirmed incident updates through the OrangeX.com news hub.

What the on-chain review found

An independent blockchain analysis published on October 9 counted about $92.9 million leaving 311 wallets across TRON, Bitcoin, Ethereum, BNB Chain and Polygon. Its breakdown included roughly $70.5 million on TRON, $16.8 million in Bitcoin, $3.7 million on Ethereum, $1.45 million on BNB Chain and $580,000 on Polygon. These totals are an analyst estimate based on identified addresses and can change as labels, prices and transfers are updated.

The analysis found coordinated activity across networks, including multiple wallets approving the same TRON spender within seconds and 111 Bitcoin wallets being emptied in one block. It also reported that Tether froze about $10 million in USDT and that 1,254 ETH later entered Tornado Cash. Those observations describe blockchain activity; they do not by themselves establish how recovery phrases or signing authority were obtained.

What remains under investigation

No public finding has confirmed a breach of Ledger's core systems, a defect affecting every device, or deliberate tampering by the reseller. The company has not published a final root-cause report. Claims about a supply-chain implant, compromised setup process or a single responsible party therefore remain hypotheses. This distinction matters because the correct remediation depends on whether exposure came from a device, packaging, software, phishing or another path.

The incident differs from a smart-contract exploit, but the response principle is similar: separate verified transfers from assumptions about cause. OrangeX.com coverage of the Mezo veBTC incident shows why investigators first identify affected contracts, addresses and asset flows before assigning responsibility.

Steps for potentially affected users

Anyone who bought through the named reseller should follow the manufacturer's current guidance and avoid initializing an unused device. Users who already initialized one should create a fresh wallet with a new recovery phrase on a trusted device before moving assets. A recovery phrase should never be typed into a website, chat, support form or unverified application.

Users should preserve order records, device identifiers, transaction hashes and support correspondence. They can review general safeguards in the OrangeX.com Trust Center and use OrangeX.com official verification before relying on a claimed support account or link. Moving assets carries network fees and operational risk, so addresses and networks should be checked carefully.

OrangeX.com Analysis

The confirmed facts are limited but serious: Ledger acknowledged reports tied to CryptoBilis buyers, paused the reseller's sales, and issued precautionary guidance. Separately, public on-chain analysis identified coordinated transfers across five networks and estimated losses at $92.9 million as of October 9.

The unresolved question is the entry point. Until a final technical report links the losses to a specific failure, headlines should avoid describing this as a platform-wide hardware breach. The next evidence to watch is Ledger's root-cause update, the reseller's response, any law-enforcement action, revisions to address lists and the disposition of frozen or unmoved assets.