Ledger now claims that every confirmed case in its ongoing exploit investigation involves devices sold by CryptoBilis, a Southeast Asian reseller. The company says up to $93 million has been traced in connection with those cases, and $10 million has been frozen. The disclosure narrows the focus of a probe that had, until now, left users guessing which sales channels were affected.
What Ledger is pinning on CryptoBilis
The statement ties the confirmed incidents to hardware that passed through CryptoBilis, a reseller operating across Southeast Asia. That's a specific claim, and it matters because it shifts the question from "is the firmware safe?" to "how did these devices get into users' hands?" Ledger isn't naming individual buyers or saying how many units are involved. It's saying the pattern points back to one reseller.
The money figure — up to $93 million traced — gives a sense of scale. The $10 million frozen is the part that's actually been clawed back so far. The gap between those two numbers is the story: tracing funds is one thing, recovering them is another. Law enforcement and exchanges typically move at different speeds on that front, and freezing assets usually requires cooperation across multiple jurisdictions.
The authorized-channel question
Critics say Ledger has to answer for an authorized sales channel. CryptoBilis wasn't a random marketplace seller; it was a partner. That distinction is why the pushback has been sharp. If the devices were compromised after leaving a legitimate reseller, the standard advice — "buy direct, avoid third parties" — doesn't fully cover it. If they were compromised before, that's a supply-chain problem with wider implications for how hardware wallets are distributed.
Ledger hasn't published a full timeline of when CryptoBilis devices were sold or which batches are affected. Users who bought through the reseller have been left to check their own purchase records. The company's public position, for now, is that the confirmed cases trace back to CryptoBilis and that the investigation is ongoing.
What's still missing
Three things remain unclear. First, how many devices are in scope — Ledger hasn't given a number, and the $93 million figure covers traced funds, not units sold. Second, whether any of the frozen $10 million has been returned to victims yet; there's no indication it has. Third, what happens to CryptoBilis itself. No charges have been announced against the reseller, and the company hasn't commented publicly on Ledger's claim.
The frozen amount is small relative to what's been traced, which suggests recovery efforts are still in the early stages. For affected users, the practical next step is checking whether their device came through CryptoBilis, and waiting for Ledger to publish batch details. For everyone else, the case is a reminder that "authorized reseller" and "safe" aren't automatically the same thing.
