Ledger Investigates Wallet Drains Linked to Southeast Asian Reseller CryptoBilis

Hardware wallet maker Ledger said on October 9, 2026 that it is investigating reports of lost funds among customers in Southeast Asia who bought its devices from CryptoBilis, a company listed as an official Ledger reseller in Indonesia, Malaysia and the Philippines. Ledger asked the reseller to "pause all sales and shipments of Ledger devices" while the investigation continues, according to Decrypt. As of publication, Ledger has not stated a cause, has not confirmed a loss figure, and has not said how many customers were affected.

What Ledger has told customers

Ledger's guidance splits buyers into two groups. Customers who bought a device from CryptoBilis in the past 90 days and have not yet set it up were told not to begin setup. Customers who have already set up a device were told to consider moving their assets elsewhere. In a post from its support account on X, quoted by The Block, Ledger wrote: "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed)." The company added: "We will continue to inform customers of updates as the investigation progresses."

The phrase "with new seed" matters. Moving funds to a new address generated from the same recovery phrase would leave them exposed to anyone who already knows that phrase. Only a fresh device that generates a fresh recovery phrase breaks the link to the original setup.

How large are the losses?

Every published figure comes from independent on-chain researchers, and none has been confirmed by Ledger.

The pseudonymous investigator Specter estimated losses of more than $86 million after tracing funds sent to suspected theft addresses on Bitcoin, Ethereum and Tron. Arkham data cited by Specter showed nearly $87 million at those addresses, including about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT, according to Decrypt.
A separate researcher, tanuki42, reported that more than $72 million had moved to a group of suspected theft addresses and asked affected users to contact the SEAL 911 incident-response group, The Block reported.

Specter first described the inflows as coming from hundreds of victim wallets, then clarified that the number of affected wallets is not yet known. It is also unclear whether the two estimates cover the same transactions, or whether every theft traced so far is linked to the reseller.

The supply-chain question

No device tampering has been confirmed. The leading hypothesis discussed publicly is a supply-chain attack, in which devices are altered or substituted before they reach the buyer. CoinDesk described one version of that scenario: a device shipped with a recovery phrase the attacker already knows. A wallet set up that way looks normal to its owner, but the attacker can sweep its funds whenever they choose. CoinDesk stressed that there was no confirmation that this is what happened.

Several industry figures weighed in. Former Binance chief executive Changpeng Zhao said the available information pointed to a supply-chain attack involving one vendor, in which a small number of users may have bought fake or tampered devices. "Self-custody comes with extra responsibilities," he said, as quoted by The Block. Mark Karpeles, the former Mt. Gox chief executive, said the reports could be linked to an issue he was already examining. He asked affected users to contact him or to open their devices and photograph the circuit board so it could be checked for signs of tampering.

Why this matters for hardware wallet security

A hardware wallet's protection rests on one assumption: the recovery phrase is generated inside the device and is known only to its owner. Any step between the factory and the buyer is an opportunity to break that assumption, whether through a counterfeit device, a pre-initialized one, or packaging that includes a printed recovery phrase. An authorized reseller listing does not remove that risk if the reseller's own inventory or logistics are compromised.

For buyers in the affected markets, the practical steps follow Ledger's own guidance. Hold off on setting up any device bought from CryptoBilis in the past 90 days. If a device has already been set up, move assets to a new signer initialized with a new recovery phrase. Report suspected losses through official Ledger support channels or to SEAL 911.

What to watch

Key open questions include whether Ledger confirms the cause, whether forensic examination finds physical tampering or substituted hardware, how many customers were affected, and whether any of the funds sent to the traced addresses on Bitcoin, Ethereum and Tron can be frozen. Stablecoin balances such as the roughly $16.5 million in USDT reported at the theft addresses are the portion most open to an issuer freeze, though no freeze has been reported.