Ledger probes crypto losses linked to CryptoBilis buyers

• Ledger says it is investigating reports of losses from people in Southeast Asia who bought its devices through CryptoBilis.
• It advised buyers from the previous 90 days not to set up unused devices; those already using one should consider moving assets to a new signer with a new recovery phrase.
• Blockchain-analysis firm Bitquery counted $93.2 million leaving 315 wallets across six networks. That is an estimate, not a confirmed loss total or a count of customers.
• The Defiant reported on 10 October that CryptoBilis had stopped selling all hardware-wallet stock, beyond Ledger devices.

Ledger’s investigation puts a spotlight on a basic trust question for hardware wallets: whether the device a customer receives is the device its manufacturer intended them to use. But Ledger has not publicly established how the reported losses happened or whether every reported wallet drain belongs to one incident.¹²

The company’s 9 October warning said it had asked CryptoBilis to pause sales and shipments of Ledger devices while it investigated. It also urged people who bought from the reseller in the previous 90 days not to set up unused devices. Customers who had already set one up were told to consider moving their assets to a new signer using a new recovery phrase.¹³

Bitquery’s analysis traced about $93.2 million leaving 315 wallets on TRON, Bitcoin, Ethereum, Solana, BNB Chain and Polygon. It found patterns consistent with one actor controlling the keys to the drained wallets. But blockchain records cannot reveal where those keys came from, and 315 wallets does not mean 315 people: one customer may control several wallets.⁴

The estimate also is not a final account of customer losses. Earlier estimates reported by The Block exceeded $72 million and $86 million, with uncertain scope. None was confirmed by Ledger.³

The Defiant reported on 10 October that Ledger said CryptoBilis had halted sales of all hardware-wallet stock while the investigation continued. That would extend the pause beyond Ledger products. Its accessible report also said an affected user’s device contained a hardware implant, but the device’s purchase history and the finding’s connection to the reported losses were not established in the material available. The claim does not show that an implant caused the thefts.⁵

That distinction matters. A modified device could raise questions about the supply chain, but finding an implant would not by itself show that it captured recovery phrases or caused any particular wallet to be drained. Tibane Labs, which examined two modified Ledger devices, said neither was bought from CryptoBilis and that it had not tested the reseller’s stock.⁶

Ledger’s advice is precautionary, not a finding that all CryptoBilis devices—or Ledger products generally—are compromised. The investigation has yet to establish how many customers were affected, whether all the reported losses are linked, or how the keys reached whoever moved the funds.²

Footnotes

1. Ledger Support statement, 9 October 2026, reproduced by BitPinas and The Block. ↩ ↩²

2. CoinDesk, “Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen”. ↩ ↩²

3. The Block, “Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses”. ↩ ↩²

4. Bitquery Research, “The Ledger CryptoBilis hack took $93.2M from 315 wallets”. ↩

5. The Defiant, “Ledger Says Affected User’s Device Contained Hardware Implant”. ↩

6. Tibane Labs, “Ledger Nano X implant field report”. ↩