Short answer: On October 9, 2026, Ledger said it is investigating reports of lost funds among customers in Southeast Asia who bought its devices from CryptoBilis, an authorized reseller in Indonesia, Malaysia and the Philippines. Ledger asked CryptoBilis to pause all sales and shipments, told anyone who bought there in the last 90 days not to set up an unused device, and advised those who already did to consider moving assets to a new Ledger with a new recovery phrase. On-chain researchers estimate losses at more than $72 million to more than $86 million, but Ledger has confirmed neither an amount nor a cause.
What did Ledger announce?
The first notice came from Ledger's support account on X on Friday, October 9. It said the company was looking into reports of fund losses from users who had bought Ledger products through CryptoBilis and had asked the reseller to stop all sales and shipments while the review continues. A later post from Ledger's main account said the company believes the drained funds are limited to devices sold through this reseller and that it has no indication its own security infrastructure, systems or services were compromised.
In a statement to Cointelegraph, Ledger added that the problem appears isolated to the reseller and its market and that it had received no reports involving devices bought directly from Ledger. The company has not said how many customers are affected, how much was lost, or whether the devices in question were genuine units that had been opened, counterfeits or something else. As of October 9, CryptoBilis had not made a public statement, according to Gizmodo.
How big are the losses?
Only independent researchers have put numbers on the incident, and their figures are not confirmed:
- tanuki42 identified eight addresses that allegedly received more than $72 million and asked victims to contact SEAL 911, the volunteer incident-response team of the Security Alliance. He also said he could not be certain of the link to Ledger, but knew of no victim report that did not involve this reseller.
- Specter traced funds on Bitcoin, Ethereum and Tron and put the total at more than $86 million. He first spoke of hundreds of victim wallets, then clarified that the number of affected wallets is not yet known.
- Arkham data cited by Decrypt showed close to $87 million at the flagged addresses, mostly in ETH, BTC and USDT; Gizmodo saw about $71.5 million under an unverified Arkham label earlier the same day. A KuCoin news flash cited security firms estimating losses near $90 million.
It is unclear whether these estimates cover the same addresses, and whether every theft is tied to CryptoBilis. The ~$86 million figure is the most quoted one, but it remains a researcher's estimate.
Key facts
| Item | Detail |
|---|---|
| Announced | October 9, 2026, by Ledger Support and Ledger on X |
| Reseller | CryptoBilis, listed by Ledger as an authorized reseller in Indonesia, Malaysia and the Philippines |
| Ledger's action | Asked CryptoBilis to pause all sales and shipments of Ledger devices |
| Advice to buyers | Bought from CryptoBilis in the last 90 days: do not set up an unused device; if already set up, consider moving assets to a new Ledger with a new seed |
| Loss estimates | More than $72M (tanuki42), more than $86M (Specter); not confirmed by Ledger |
| Networks | Bitcoin, Ethereum, Tron |
| Cause | Not identified; a supply-chain attack is suspected by outside commentators |
| Ledger's systems | No indication of compromise, according to Ledger |
What is a supply-chain attack on a hardware wallet?
A hardware wallet is meant to generate your recovery phrase inside a secure chip and never let it leave the device. A supply-chain attack targets the stretch between the factory and your desk, so that the attacker knows or can capture the seed before you ever deposit money. The known patterns are:
- Pre-seeded device. The box contains a scratch card or printed sheet with a "recovery phrase" and instructions to use it. Whoever printed the card already has your keys. A genuine Ledger never ships with a recovery phrase or PIN set.
- Swapped paperwork. The device is genuine, but the recovery sheet or setup card has been replaced with one that tells you to restore from a supplied phrase or to enter the phrase into a computer or website.
- Counterfeit or modified hardware. A fake or altered device that looks right and may even pass a casual visual check. In 2021, after a leak of Ledger's customer database, some users received fake Ledgers by mail with extra components added.
- Fake companion app. A counterfeit wallet app that reports a fake device as genuine or asks for the seed.
In this case nothing has been confirmed. Changpeng Zhao said the available information points to a supply-chain attack involving one vendor and possibly fake or tampered devices. Former Mt. Gox CEO Mark Karpelès posted photos of a Ledger he says he bought in Malaysia, with intact shrink wrap and a hidden extra board that he describes as an LTE module able to send the seed out. He did not say it came from CryptoBilis, and it is a single device. Ledger has not accused the reseller of tampering, and a third party in the supply chain could also be responsible.
What should you do now?
If you bought a Ledger from CryptoBilis in the last 90 days:
- Unused device: do not initialize it. Keep the box as is and follow Ledger Support's updates on X.
- Already set up: consider moving funds. Ledger's advice is to move assets to a new Ledger signer with a newly generated recovery phrase. Buy the new device directly from Ledger and set it up before sending anything.
- Funds already gone: collect transaction IDs and addresses and contact SEAL 911 and Ledger Support through official channels only.
For anyone buying or checking a hardware wallet:
- Buy direct or from the official reseller list. On marketplaces such as Amazon, Shopee or Lazada, check the "Sold by" name against the manufacturer's list. A listed reseller lowers the risk but, as this case shows, does not remove it; buying from the manufacturer's own store is the shortest chain.
- Reject any pre-filled seed or PIN. If the box contains a recovery phrase, a PIN, or the device is already set up, do not use it and contact support.
- Generate the seed yourself, on the device. Write it only on paper or metal, never into a phone, computer or website.
- Run the Genuine Check in the official Ledger app downloaded from ledger.com or the official app stores. Ledger itself notes that this check cannot detect every physical implant, so it complements a trusted source rather than replacing it.
- Inspect the packaging, but do not rely on it: counterfeits are made to pass visual checks.
- Test before trusting. Send a small amount first, verify the receive address on the device screen, and wait a while before moving larger sums.
- Ignore "replacement" and "refund" offers. Incidents like this are followed by phishing emails and fake support accounts. Ledger does not send unsolicited replacement devices. See how to avoid crypto exchange scams and address poisoning and signature phishing.
For a broader view of seed backups, passphrases and real-world threats, read our guide to self-custody wallet security. If moving funds to a new wallet also involves converting them, you can compare exchanger rates on the exchangers list or swap without an account in Changerella App, which sends coins straight to the address you provide; check that address on the new device's screen first.
Why does it matter?
Hardware wallets are the standard advice for anyone leaving exchanges, and their security model assumes the device you hold is the one the manufacturer built. This case does not show that Ledger's chip or firmware was broken; Ledger says its systems were not compromised. It shows that the distribution chain is part of the threat model. The safest route is short: buy from the maker, generate your own seed, and treat any phrase that arrives in the box as already stolen.
FAQ
What happened with Ledger and CryptoBilis?
On October 9, 2026, Ledger said it is investigating reports of fund losses among Southeast Asian customers who bought Ledger devices from the reseller CryptoBilis. It asked CryptoBilis to pause sales and shipments. The cause has not been identified.
How much money was lost?
Ledger has not confirmed any figure. On-chain researchers estimate more than $72 million (tanuki42) to more than $86 million (Specter) across Bitcoin, Ethereum and Tron, and it is not yet clear whether all of it is linked to the reseller.
I bought a Ledger from CryptoBilis. What should I do?
If you bought it in the last 90 days and have not set it up, Ledger advises not to initialize it. If you already set it up, consider moving your assets to a new Ledger device with a newly generated recovery phrase, ideally bought directly from Ledger.
Are Ledger devices bought directly from Ledger affected?
Ledger told Cointelegraph it had received no reports involving devices bought directly from the company, and said it has no indication that its infrastructure, systems or services were compromised.
How can I tell if a hardware wallet has been tampered with?
A genuine device never comes with a recovery phrase or PIN already set. Run the Genuine Check in the official app, inspect the packaging, and buy from the manufacturer or an official reseller. Ledger notes the Genuine Check cannot detect every physical modification, so the source of the device matters most.