Ledger, the world’s largest hardware wallet maker, is investigating reports of drained wallets among users in Southeast Asia who purchased devices through reseller CryptoBilis, and has asked the reseller to pause all sales and shipments while the review continues. On-chain investigator Specter separately estimated that traced losses have climbed above $86 million across Ethereum, TRON, and Bitcoin.
In an official statement posted on October 9, Ledger said it believes the funds drained are limited to devices sold through CryptoBilis in South East Asia. The company has not indicated any compromise of its own hardware or core infrastructure.
What Ledger Told Buyers
Ledger recommended that anyone who bought from the reseller in the past 90 days avoid initializing a device they have not yet set up, and advised those who have already set up their wallet to move assets to a new Ledger signer using a new seed phrase. The scare is the most serious supply-chain alarm to hit a major hardware wallet vendor in years, and it lands as self-custody has grown more popular among retail and institutional users alike. The company said it will keep customers updated as the investigation progresses, a process that now sits alongside Ledger’s recent push into Bitcoin-backed lending and other consumer-facing services.
What the On-Chain Data Shows
Specter traced theft addresses receiving inflows from hundreds of victim wallets and put the total above $86 million, listing addresses across Ethereum, TRON, and Bitcoin. Blockchain analytics firm Bitquery put the figure higher still, at roughly $92.9 million drained from 311 wallets across five chains on October 9. MistTrack said Tether is freezing USDT across multiple addresses linked to the incident and that the losses it is tracking are approaching $90 million. The figures remain estimates and could move as investigators trace additional addresses.
Supply-Chain Suspicion, Not a Ledger Zero-Day
The leading explanation is a supply-chain problem rather than a flaw in Ledger’s own hardware or firmware. Binance co-founder Changpeng Zhao said the thefts appear localized to a supply-chain attack involving a single vendor, with a small number of users likely purchasing fake or tampered devices. Security researcher Taylor Monahan pushed back on zero-day speculation, writing that there is “absolutely not” such a vulnerability in Ledger. The common attack vector has not been confirmed, and CryptoBilis had not issued a public response.
What Users Should Do
For buyers who used the reseller, Ledger’s guidance is to migrate funds to a fresh signer with a new seed phrase rather than continue using an affected device. The incident reinforces a recurring self-custody lesson: a hardware wallet is only as secure as the supply chain that delivered it, a point that sits within the broader picture of blockchain and wallet security as 2026 crypto-theft totals keep climbing. Traders and exchanges will be watching whether Ledger confirms the reseller as the sole source of tampered devices and whether CryptoBilis addresses the allegations directly.
