Ledger probes $86M+ in wallet drains tied to Southeast Asian reseller CryptoBilis

Author: Crypffalo Research · 07:54 10/10/2026

Ledger is investigating reports that customers who bought hardware wallets through reseller CryptoBilis lost funds; on-chain sleuths estimate more than $86 million drained, but the cause remains unconfirmed.

Ledger probes $86M+ in wallet drains tied to Southeast Asian reseller CryptoBilis

Hardware wallet maker Ledger said on Friday, Oct 9, that it is investigating reports of fund losses among customers in Southeast Asia who bought devices through CryptoBilis, one of its official resellers. Pseudonymous on-chain investigator Specter estimates that more than $86 million has been drained across Bitcoin, Ethereum and Tron, though neither Ledger nor any independent party has confirmed the figure.

Key takeaways

Ledger has asked CryptoBilis to pause all sales and shipments while the investigation runs.
Loss estimates: more than $72 million per researcher tanuki42, later more than $86 million per Specter; it is unclear whether the two figures overlap.
CryptoBilis is an official Ledger reseller in Indonesia, Malaysia and the Philippines.
The root cause is unconfirmed; a supply-chain compromise is the most widely discussed theory.
There is no confirmed evidence that Ledger's own systems or wallet technology were breached.

What happened

The episode surfaced through posts on X and Reddit from users reporting emptied wallets. Tracing those reports, tanuki42 flagged more than $72 million flowing to suspected theft addresses. Specter then followed funds across three chains and raised the estimate above $86 million. Specter initially said the money came from "hundreds" of victim wallets but later clarified that the actual number of affected wallets has not been established.

Ledger has not confirmed the size of the losses or their cause. The company said it has received reports of missing funds from customers who purchased through CryptoBilis and will share updates as the probe progresses. Finance Magnates noted that it is also not proven that every transaction in the $86 million estimate involves a CryptoBilis customer.

Why a supply-chain attack is suspected

Hardware wallets are designed so the private key never leaves the device. But if a unit is swapped or tampered with before it reaches the buyer, an attacker could ship it with a recovery phrase they already know, then simply wait for the victim to deposit funds and sweep them. CoinDesk outlined this scenario while stressing it has not been confirmed as the cause.

Binance co-founder Changpeng Zhao said the available information points to a supply-chain attack involving a single vendor, with a small number of users possibly receiving fake or tampered devices. Former Mt. Gox CEO Mark Karpeles said the reports may be linked to an issue he was already looking into and asked affected users to photograph their device circuit boards to check for tampering. Other explanations, such as previously exposed recovery phrases or phishing-driven malicious approvals, have not been ruled out.

What Ledger is telling customers

If you bought from CryptoBilis in the past 90 days and have not set up the device: do not begin setup.
If you already set it up: consider moving assets to a new Ledger signer with a freshly generated recovery phrase (replace both device and seed).
Use only Ledger's official support channels. Affected users can also contact the security response group SEAL 911.

What it means for crypto markets

In dollar terms, the incident is smaller than several exchange hacks this year, including the roughly $350 million to $390 million Bitget breach in September cited by CoinDesk and Finance Magnates. Direct price impact on BTC or ETH is therefore likely limited, especially with markets currently driven by oil prices, U.S.–Iran tensions and Fed rate expectations.

The confidence hit is more meaningful. Hardware wallets are widely treated as the safe option for retail self-custody, and this case lands in a fast-growing Southeast Asian retail market. In a constructive scenario, investigators quickly isolate a single tampered batch, Ledger lays out clear remediation and some funds are traced or frozen. In a downside scenario, confirmed losses grow, other distribution channels turn out to be affected, and the confusion fuels a wave of phishing scams impersonating "Ledger support."

The core lesson is unchanged: buy hardware wallets only from the manufacturer or its listed resellers, always generate a new seed during setup, and never use a device that arrives with a pre-printed recovery phrase.

What to watch next

Ledger's next official update on root cause, number of affected users and any support plan.
Movements from the suspected theft addresses, including any routing through exchanges or mixers, or freezes.
Phishing emails and messages impersonating Ledger in the coming days.
Macro remains the bigger driver for prices: check the economic calendar and real-time liquidations.

Frequently Asked Questions

Are Ledger devices bought outside Indonesia, Malaysia and the Philippines affected?

Current reports center on CryptoBilis in those three countries. There is no information about other channels so far, but if you are unsure of your device's origin, check with Ledger through official support.

Was Ledger itself hacked?

Not according to available evidence. CoinDesk reports no confirmed compromise of Ledger's systems or wallet technology; the probe focuses on devices sold through a third-party reseller.

How can I tell whether my hardware wallet is safe?

A genuine new device should have you generate your own recovery phrase during setup. A seed phrase printed in the box, or a device that arrives "pre-activated," is a red flag, so do not deposit funds.

*This content is for information only and is not financial advice.*

Tags: Ledger, Security, Hardware Wallet, Southeast Asia

Crypffalo: Crypto news & data