Ledger says every confirmed case in the suspected $87 million drain traces back to CryptoBilis, the reseller that supplied the compromised devices. The hardware wallet maker's own systems and direct sales channels are unaffected, according to its statement. CryptoBilis has stopped selling hardware wallets entirely.
Where the losses actually sit
The distinction matters because Ledger ships through two very different pipes. Direct orders go straight from the company; third-party resellers like CryptoBilis sit in between. Ledger's line is that the problem lives in the reseller channel, not the factory. If that holds up, the blast radius is limited to customers who bought through CryptoBilis rather than Ledger itself.
That's a big if. Resellers move a lot of volume, and CryptoBilis wasn't some back-alley operation. People bought from it precisely because it looked legitimate.
CryptoBilis goes quiet on sales
The reseller has pulled hardware wallets from its shelves. No timeline for a return, no public explanation of what went wrong on its end. For customers holding a device bought through CryptoBilis, that silence is the problem. Ledger's statement tells them where the issue isn't. It doesn't tell them what to do with the hardware in their hands.
The $87 million question
The figure is still described as suspected, which means the full accounting isn't public. Ledger has confirmed the cases it can tie to CryptoBilis and drawn a line around everything else. Whether that line survives scrutiny depends on details neither company has released: which batches, which production runs, how the compromise got in.
Hardware wallets exist to remove exactly this kind of counterparty risk. A reseller breach doesn't break the cryptography, but it does break the promise that you only have to trust the device in your pocket. Buyers who went through a middleman are now finding out which promise they actually got.
Ledger hasn't said whether it will compensate affected customers or help them migrate. CryptoBilis hasn't said anything at all. Until one of them does, the suspected $87 million figure stays a floor, not a final tally.
