Ledger Announced Investigation amid Theft of over $86M from Users

Published: October 10, 2026 – 07:41 UTC

Ledger has suspended sales via the CryptoBilis reseller following reports of lost funds in Southeast Asia.
Analysts link the incident to a possible supply chain compromise of devices, but the official cause has not yet been confirmed.
Researchers estimate total losses exceeded $86 million across the bitcoin, Ethereum, and TRON networks.

French company Ledger is investigating reports of cryptocurrency theft from hardware wallet owners who purchased devices through the CryptoBilis reseller in Southeast Asia.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.Reach out to Ledger customer support through official channels with any questions: https://t.co/4p918UH8yb
— Ledger Support (@Ledger_Support) October 9, 2026

On October 10, 2026, the company said on X that it had asked the seller to pause sales and shipments of devices during the review. According to blockchain researchers, hundreds of wallets may have been affected, and total losses exceeded $86 million.

Ledger Suspended Sales via CryptoBilis

In a statement, Ledger said it is investigating reports of lost funds from users who purchased devices through the reseller. During the review, the company asked CryptoBilis to halt sales and shipments of hardware wallets.

Ledger also provided recommendations for customers who bought devices from this seller over the past 90 days:

If the device has not been set up yet, the company recommends not starting the setup for now
If the wallet has already been set up, Ledger advises considering moving assets to a new device with a new seed phrase

The company promised to inform customers about the results of the investigation. At the same time, the cause of the thefts has not yet been officially established.

Binance co-founder Changpeng Zhao (CZ) suggested that the incident may be linked to a supply chain attack via a single vendor. According to him, a small number of users may have purchased counterfeit or modified Ledger devices.

Beware if you use a Ledger hardware wallet, especially if you bought one recently.Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers.Ledger is one of the most secure and oldest hardware wallets in the industry. Stood the test of time. But these things happen.I expect and know all BNB ecosystem players (and all industry) to help trace and recover the funds.
— CZ BNB (@cz_binance) October 9, 2026

“Hardware can be tempered with, software official website can be hacked. Self custody comes with extra responsibilities,” Zhao emphasized.

At the same time, former Mt. Gox exchange CEO Mark Karpelès said he received a Ledger hardware wallet from Malaysia with a hidden spyware module, even though the device’s factory packaging was intact.

My spy-implanted ledger came from Malaysia, and had flawless shrink wrap. Even opening it, at first you don’t see the implant which is cleverly hidden where the screen’s padding is supposed to be.Follow Ledger’s guidance to check yours: https://t.co/FlOjWvqkZw https://t.co/D8mixF1o9L
— Mark Karpelès (@MagicalTux) October 9, 2026

According to him, inside a Ledger Nano X they found a 2×2 mm microchip connected to the data lines on the screen that intercepts the 24 words of the seed phrase during wallet setup. The module stores the captured data and transmits it to attackers via a cellular modem with a SIM card and antenna, without disrupting the main secure chip, meaning Ledger’s authenticity check can still pass successfully.

Karpelès added that newer modifications are harder to detect even after disassembling the device and, likely, can be installed at scale.

Researchers Traced More Than $80 Million in Stolen Assets

Blockchain analyst Specter reported numerous complaints on X and Reddit about Ledger users’ wallets being drained. According to him, addresses linked to the thefts received funds from hundreds of wallets across several major blockchains, including bitcoin, Ethereum, and TRON. He estimated total losses at more than $86 million.

There have been a reports on X and Reddit of wallet-draining by Ledger users.I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin. Total losses $86M+bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dlTK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6CTBkcUMYC7CkTK99tkTnaStQVBastfrs9d9TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW0x69c8f401cfc6cd40ac94691d6d7c48e3b7a478410x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a0x83aeac166f6832ae3500000a24510a95a052a599bc1qqnkwurxs99xkx5t4yffqhq3u6qwy0qpjyujtm9bc1qgqheemzla77pesl227hdtgf5ykz62d0zvld26nTSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a
— Specter (@SpecterAnalyst) October 9, 2026

Analytics platform Arkham began tracking the relevant addresses under the name cryptobilis-ledger-drainer. According to the data it published, as of publication, 158 addresses held assets worth around $71 million.

The incident comes amid a string of attacks and leaks involving hardware wallet manufacturers. In early August 2026, Coldcard users lost nearly $89 million in a large-scale attack. In August, Trezor reported a data leak affecting 13,689 customers due to a hack of logistics partner ShipMonk, and in September — a compromise of a third-party email provider, whose infrastructure was used for phishing campaigns.

Сообщение Ledger Announced Investigation amid Theft of over $86M from Users появились сначала на INCRYPTED.

Source: Incrypted