Contents
Investigation Overview and Reseller Directives
On October 9, 2026, Paris-based hardware wallet manufacturer Ledger announced an investigation into reports of unauthorized asset drains affecting clients in Southeast Asia 12. The reports originate from individuals who bought hardware signers through CryptoBilis, an authorized third-party reseller located in Kuala Lumpur, Malaysia 12. In response to the initial complaints, Ledger requested that CryptoBilis immediately halt all sales and distribution of its hardware devices 13. Furthermore, the manufacturer urged anyone who purchased a device from this specific reseller within the preceding 90 days to suspend device setup 12. For clients who have already initialized their signers, Ledger recommended transferring stored digital assets to an alternative signer generated with an entirely new seed phrase 13.
The warning came after affected clients posted detailed accounts of missing funds across social media platforms including Reddit and X 12. While Ledger has not confirmed the total number of compromised wallets, the firm stressed that the issue appears confined to this single distributor and regional market 12. The manufacturer emphasized that products ordered directly through its primary store remain unaffected, and no internal infrastructure, core systems, or network services suffered a breach 1. Founded in 2014, Ledger has distributed over 7 million devices globally to assist users in maintaining offline control of private keys 2. Consequently, any reports suggesting potential supply-chain vulnerabilities draw significant attention across the digital asset security ecosystem 2.
On-Chain Tracking and Loss Estimates
Although Ledger has not officially validated a precise loss figure, external on-chain tracking suggests tens of millions of dollars have been extracted 13. On October 9, 2026, pseudonymous blockchain security analyst Specter reported tracing suspect addresses across multiple blockchain networks following public user reports 12. Specter's initial findings indicated that cumulative unauthorized transfers exceeded $86 million from hundreds of distinct victim wallets 12. Further analysis utilizing Arkham blockchain data showed wallet balances totaling nearly $87 million associated with the identified theft addresses 3.
The targeted assets span several prominent networks, primarily including Bitcoin, Ethereum, and Tron 23. Specifically, data compiled from Arkham indicated that the designated recipient addresses held approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT 3. Despite these detailed blockchain records, analysts note that it remains unverified whether every flagged transaction directly stems from hardware distributed by CryptoBilis or if multiple distinct vectors are involved 23. Neither Ledger nor independent security firms have published a final list confirming all affected wallet addresses 12.
Potential Vectors and Supply-Chain Analysis
Hardware signers are engineered to isolate private cryptographic keys from internet-connected environments to prevent remote exploitation 23. However, security researchers emphasize that physical supply-chain attacks represent a persistent risk vector for third-party retail channels 2. In a typical supply-chain compromise, an intermediary actor tampers with a physical device before it arrives at the end consumer 2. For instance, an attacker might pre-configure a device with a recovery phrase that they already record and control 2. When an unsuspecting user deposits funds into a wallet generated from that pre-established seed phrase, the attacker can sweep the deposited assets at any subsequent time 2.
However, there is no confirmation that physical device tampering or pre-generated seed phrases caused the reported losses 23. Ledger's ongoing probe aims to verify whether physical units were altered in transit, compromised at the reseller's facility, or targeted via secondary phishing methods 12. Security analysts reiterate that hardware architecture compromises differ fundamentally from system-wide software breaches 2. Because Ledger's central infrastructure remains intact, the investigation centers on hardware handling and administrative oversight within local supply chains 12.
Hardware and Ecosystem Security Context
The investigation unfolding around CryptoBilis occurs during a broader sequence of major security incidents impacting cryptocurrency custody in 2026 12. In July 2026, competing hardware vendor Coinkite experienced an exploit affecting its Coldcard signers 1. A firmware bug in those units caused flawed seed phrase generation, enabling malicious actors to calculate recovery words and steal nearly $120 million in bitcoin 1. Galaxy Research later observed that multiple distinct entities independently exploited the same underlying firmware flaw over the following months 1.
Other hardware and custody providers have also encountered operational breaches during the same calendar year 12. In September 2026, hardware wallet maker Trezor revealed that a data breach at its third-party fulfillment partner exposed personal information belonging to nearly 81,000 customers 1. Additionally, attackers targeted user contact information through Ledger's third-party payment vendor, Global-e, to distribute targeted phishing communications 1. Major protocol and exchange compromises have also elevated market losses in recent months, including a $350 million to $387 million exploit at Bitget attributed by researchers to North Korean state-sponsored actors 23. Other notable incidents involved a $320 million withdrawal from Blockstream's Liquid sidechain, $285 million to $295 million extracted from Drift, and $293 million lost from Kelp 23.
What is not yet established
- The exact technical mechanism used to compromise user funds, including whether devices were physically tampered with prior to delivery
- The confirmed total monetary loss and exact number of individual users affected by the incident
- Whether all drained addresses identified by on-chain tracking stem exclusively from CryptoBilis sales
Frequently asked questions
Did Ledger's internal systems or software infrastructure suffer a breach?
No. Ledger stated that its core infrastructure, software services, and internal systems were not compromised, and no issues have been reported for products bought directly from Ledger 1.
What steps should customers who purchased from CryptoBilis follow?
Ledger advises clients who bought devices from CryptoBilis within the last 90 days not to set them up 12. Users who have already initialized devices from this vendor should transfer their funds to a fresh device generated with a new seed phrase 13.
Sources
- Bitcoin Magazine — Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses (2026-10-09) https://bitcoinmagazine.com/news/ledger-warns-users-after-losses-reported
- CoinDesk — Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen (2026-10-09) https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen
- Decrypt — Ledger Probes Potential Theft of $87M in User Funds Tied to Crypto Wallet Reseller (2026-10-09) https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller
Revision history
Published