Ledger said on October 9, 2026 that it was investigating fund losses linked to hardware wallets purchased through CryptoBilis, a Southeast Asian reseller, with early estimates topping $86 mil
Ledger, the hardware wallet maker, disclosed on October 9, 2026 that it was investigating a security incident tied to devices sold through CryptoBilis, a reseller operating in Southeast Asia, after reports surfaced of significant fund losses among customers who had purchased their hardware wallets through that specific sales channel rather than directly from Ledger or its other authorized retailers. Early estimates of the total losses across affected users topped $86 million, according to reporting that cited Ledger’s own public statements on the matter.
In response, Ledger’s official support account issued specific guidance aimed at limiting further damage while the investigation proceeded. Anyone who had purchased a Ledger device from CryptoBilis within the preceding 90 days was advised not to begin the device setup process at all, out of caution that compromised units could be designed to expose a user’s recovery phrase or private keys during initialization. For users who had already completed setup on a device bought through CryptoBilis, Ledger’s guidance was more urgent: move any assets held on that device to a new Ledger signer initialized with an entirely fresh seed phrase, rather than attempting to simply continue using the potentially compromised device.
As part of its response, Ledger said it had formally asked CryptoBilis to pause all sales and shipments of its products while the investigation into the fund losses continued, a step aimed at preventing additional customers from purchasing potentially compromised units through that channel while the scope and cause of the problem remained under review. The incident fits a pattern security researchers have long warned about in the hardware wallet industry, where devices purchased through unauthorized or loosely vetted third-party resellers carry meaningfully higher risk of tampering than units bought directly from a manufacturer or its officially vetted retail partners, since a compromised supply chain can introduce malicious firmware or hardware modifications before a device ever reaches its intended buyer.
Ledger has previously dealt with reseller-related and supply-chain security concerns in other contexts, and hardware wallet manufacturers across the industry generally urge customers to buy exclusively from a brand’s own website or explicitly authorized retail partners for exactly this reason, since physical possession of a device before it reaches the end user creates an opportunity for tampering that no amount of software-side security can fully guard against once a user trusts and sets up a compromised unit.
The company’s guidance, issued through its official support channel on Ledger’s verified X account, did not specify how many individual customers were affected or provide a final confirmed loss total, describing the $86 million figure as an estimate while the investigation remained ongoing. Ledger did not say whether it planned to compensate affected customers directly or whether the matter would be pursued as a legal action against CryptoBilis once the scope of the incident is fully understood.
This post first appeared in Ledger Pauses Reseller Sales After Wallets Bought Through It Lose Tens of Millions
