USD
Ledger Probes CryptoBilis Wallet Drains as Loss Estimates Top $86 Million
Buyers warned against device setup as tampering concerns surface
TL;DR
- Ledger is investigating missing-fund reports tied to devices sold by authorized reseller CryptoBilis and has asked it to pause sales and shipments.
- Onchain estimates rose from more than $72 million to more than $86 million across Bitcoin, Ethereum and Tron, but the totals remain unconfirmed.
- Buyers from the past 90 days were told not to set up unused devices, while existing users were advised to consider moving assets to a new signer with a new seed.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
Ledger said Friday, Oct. 9, 2026, it is investigating crypto losses reported by customers who bought hardware wallets from CryptoBilis, an authorized reseller in Southeast Asia. The cause remains unresolved, and the largest onchain estimate puts suspected losses above $86 million without independent confirmation.
CryptoBilis is listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger asked the company to pause all sales and shipments while the investigation continues.
"We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," Ledger's support account said. "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses."
Loss estimates climb as researchers trace suspected theft addresses
Onchain researcher tanuki42 asked affected users to contact crypto security response group SEAL 911.
Specter initially said the suspected funds came from hundreds of victim wallets, then clarified that the actual number of affected wallets was not yet known. Specter said the addresses were traced after reports from Ledger users appeared on X and Reddit.
Former Mt. Gox CEO Mark Karpeles said the reports could be connected to an issue he was already investigating. He asked affected users to contact him or open their Ledger devices and send pictures of the circuit board, saying those images could help show whether a device had been tampered with.
Binance co-founder Changpeng "CZ" Zhao said the available information suggested a possible supply-chain attack involving one vendor and that a small number of customers may have received fake or tampered devices. "Beware if you use a Ledger HW wallet. Especially if you got one recently," Zhao said.
"I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds," Zhao added. "Self-custody comes with extra responsibilities."
Supply-chain theory remains unconfirmed
One possible scenario is that hardware wallets were altered before reaching customers. A device could, for example, arrive with a recovery phrase already known to an attacker, who could later use it to access deposited funds. That would differ from a compromise of Ledger's own systems, but there is no confirmation that tampered devices or pre-generated recovery phrases caused the reported losses.
Ledger, founded in 2014 and based in Paris, says it has sold more than 7 million hardware wallets worldwide. The current investigation concerns devices sold through a third-party reseller, with no confirmed evidence that Ledger's own systems or wallet technology were compromised.
The case comes during a year that has included several major crypto exploits. DefiLlama data cited in the reporting listed the following incidents:
This article has been refined and enhanced by ChatGPT.
