Inside the $91M Ledger Reseller Wallet Theft

What it is

Galaxy Research's account of the roughly $91M theft from buyers of Ledger wallets sold by the reseller CryptoBilis (listed on Ledger's site as an authorized reseller for Indonesia, Malaysia and the Philippines). It matters mainly for who is exposed and what Ledger told them to do.

How it works

• A separate component inside the enclosure reads the screen during setup, captures the 24-word phrase and sends it out over LTE through a provisioned eSIM.
• The Secure Element and Ledger's OS are untouched, so Genuine Check passes on a tampered unit. Do not treat that check as evidence of integrity.
• Independent teardowns have found at least three generations of the implant. The latest is a professionally fabricated flex circuit hidden under the display.
• Ledger says its own systems and direct sales channels were not compromised, and that every confirmed case so far involves CryptoBilis.

Preconditions / Affected

• Anyone who bought through CryptoBilis, which Ledger told to check the past 90 days.
• Restoring an existing seed onto a tampered device is also exposed. Some drained addresses date to 2021, which Galaxy reads as old seeds restored onto tampered units.
• Nearly all drained bitcoin addresses had never spent before, so these were cold-storage balances.

What to do

Ledger's instructions to CryptoBilis buyers:

• If you have not set the device up, don't.
• If you already did, move funds to a new device with a newly generated seed.

Galaxy's general guidance:

• Buy direct from the manufacturer.
• Treat any device that arrives already set up, or with a pre-printed seed, as compromised.
• For balances you cannot afford to lose, spread keys across vendors and locations, so one tampered device or buggy RNG is a scare rather than a loss.
• Institutions should use custody controls that assume any one device or vendor can fail.

Caveats

• Galaxy's tally is a floor: it covers Bitcoin, Ethereum, Arbitrum, Polygon and TRON but not BNB Chain. Other trackers say $93M to $95M.
• Ledger calls the volume "limited." The page says "at least one" implanted device was confirmed, and the scope beyond CryptoBilis is not established.
• As of Oct. 15, about $56.6M was still at attacker addresses and only Tether's $10M freeze is recoverable. Galaxy argues bitcoin and ETH cannot be clawed back.
• Galaxy explicitly does not attribute the quarter's incidents to AI tooling. The AI framing is its opinion, not a finding.