In brief
- Ledger is investigating reported losses among Southeast Asian customers who bought devices from reseller CryptoBilis, and has asked the reseller to pause sales and shipments.
- The company told anyone who bought from CryptoBilis in the past 90 days not to set up their device, and those who have to move funds to a new device with a fresh seed phrase.
- Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. Ledger hasn’t confirmed the figure or the cause.
Ledger is telling some customers to hold off on setting up their hardware wallets.
The Paris-based wallet maker said Friday it is investigating reports that users in Southeast Asia who bought devices from a reseller called CryptoBilis have lost funds.
“As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices,” the company’s support account wrote on X.
Ledger urged anyone who bought from the reseller in the past 90 days not to set up their device if they haven’t already. Those who have should consider moving their assets to a new Ledger signer with a new seed phrase, the master backup that can regenerate a wallet’s private keys.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…
— Ledger Support (@Ledger_Support) October 9, 2026
Ledger didn’t say what caused the losses or how many customers were affected. Hardware wallets are designed to keep private keys offline, but a device compromised before it reaches the buyer, such as one shipped with a recovery phrase an attacker already knows, can leave funds exposed. No tampering has been confirmed.
The losses may be large, potentially in the tens of millions of dollars. Pseudonymous crypto investigator Specter said they traced theft addresses flagged in reports from Ledger users on X and Reddit and found inflows from hundreds of victim wallets across Ethereum, Tron, and Bitcoin.
There have been a reports on X and Reddit of wallet-draining by Ledger users.
I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin.
Total losses $86M+… pic.twitter.com/c5dhQeAZ0l
— Specter (@SpecterAnalyst) October 9, 2026
“Total losses $86M+,” Specter wrote. Arkham data shared by the investigator shows nearly $87 million at those addresses, including about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT. Ledger hasn’t confirmed the figure, and it’s unclear whether every theft is linked to the reseller.
Rival Trezor has faced its own security headaches, including customer data exposed in a shipping partner breach and a breach of its email just last month.
→The episode adds to a brutal stretch for crypto security. Last month, Bitget lost roughly $387 million in a hack that investigators have tied to North Korea, and blockchain tracking firms Chainalysis and Elliptic have since traced part of the haul.
North Korean hackers also spent six months infiltrating Solana exchange Drift before a $285 million exploit, and Drift has since laid out a plan to repay users. In September, self-described white hat hackers withdrew $320 million in Bitcoin from Blockstream’s Liquid sidechain before negotiating with the company.