In Brief: Ledger is investigating reported cryptocurrency thefts exceeding $86 million and has instructed Southeast Asian reseller CryptoBilis to suspend device sales. Blockchain researchers
More than $86 million in cryptocurrency has reportedly been stolen from Ledger wallet users, raising concerns about a possible supply chain attack involving compromised hardware devices. According to Ledger Support, the company is investigating reports of stolen funds involving customers who purchased hardware wallets from CryptoBilis, a reseller operating in Southeast Asia.
Ledger has issued precautionary instructions to customers who purchased devices through CryptoBilis as it investigates the reported cryptocurrency thefts. According to the company’s announcement, customers who purchased devices from the reseller within the previous 90 days should avoid activating unconfigured wallets.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…
— Ledger Support (@Ledger_Support) October 9, 2026
Also Read: Visa and ADI Foundation Explore Blockchain Links for Global Payment Networks
Customers who already initialized their devices were advised to consider transferring their cryptocurrency holdings to new Ledger signers with different recovery phrases. The company also directed affected customers to its official support channels for assistance and further information regarding the investigation.
Blockchain researchers have identified suspicious cryptocurrency transactions involving hundreds of wallets, providing additional details about the scale of the reported thefts. According to blockchain investigator Specter’s October 9 analysis, ten suspicious addresses received more than $86 million across Bitcoin, Ethereum, and TRON networks.
The researcher found that the identified addresses held approximately $25 million during the latest assessment, indicating substantial funds had already moved elsewhere. Another investigator, tanuki42, previously identified eight suspicious addresses and estimated losses exceeding $72 million from the reported incidents.
There have been a reports on X and Reddit of wallet-draining by Ledger users.
I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin.
Total losses $86M+… pic.twitter.com/c5dhQeAZ0l
— Specter (@SpecterAnalyst) October 9, 2026
Specter’s subsequent findings included those eight addresses alongside two additional Bitcoin addresses, expanding the number of addresses associated with the suspected thefts. Security Alliance also urged affected cryptocurrency holders to contact its SEAL 911 service for assistance with tracing stolen assets and reporting suspicious transactions.
The investigation has also drawn attention to potential hardware tampering, with former Mt. Gox CEO Mark Karpelès examining whether malicious components were installed inside Ledger devices. According to Karpelès, he is investigating whether attackers physically modified Ledger hardware wallets before distributing them to customers.
He requested photographs of affected devices’ internal circuit boards to determine whether unauthorized components had been installed alongside legitimate hardware. His investigation also highlighted limitations in Ledger’s Genuine Check feature, which verifies device authenticity through its security architecture.
POSSIBLE SUPPLY CHAIN ATTACK BEHIND $86 MILLION LEDGER WALLET THEFTS
Former Mt. Gox CEO Mark Karpelès is investigating whether malicious hardware implants were inserted into Ledger devices in a potential supply chain attack affecting customers in Southeast Asia.
Ledger has… https://t.co/Zew4LAihRl
— Bitcoin News (@BitcoinNewsCom) October 9, 2026
Ledger’s documentation acknowledges that its verification process cannot identify certain unauthorized physical modifications when the original Secure Element remains intact. Karpelès has not confirmed the presence of malicious implants in affected devices, leaving the suspected supply chain attack unverified.
Binance founder Changpeng Zhao also addressed the reported thefts, suggesting that compromised devices distributed through a single reseller could explain the incidents. According to Zhao, preliminary information points toward a possible supply chain attack involving counterfeit or tampered hardware wallets.
He emphasized Ledger’s established security record while acknowledging that hardware devices remain vulnerable to interference during distribution. Zhao recommended that cryptocurrency holders exercise caution when purchasing wallets and avoid transferring substantial funds immediately upon receiving new devices.
One security tip.
When you buy a hardware wallet (or download a new software wallet), leave it for a couple of weeks before moving any meaningful amount of funds to it.
And follow the news in those weeks (and after), for hacks, etc. Hardware can be tempered with, software… https://t.co/TFsx64UihY
— CZ
BNB (@cz_binance) October 9, 2026
Changpeng Zhao expressed confidence that blockchain industry participants would assist investigators in tracing stolen cryptocurrency and supporting potential recovery efforts.
The unresolved attack method has left Ledger customers facing uncertainty over whether the reported thefts involved compromised hardware, malicious applications, or phishing attacks. Users should verify wallet software sources, avoid entering recovery phrases into computers or mobile devices, and carefully examine transactions before authorization.
If investigators identify compromised third-party applications or phishing schemes, stronger software verification and recovery phrase protection could help prevent similar incidents. A confirmed hardware or firmware vulnerability could require security updates or migration to newly configured devices with different recovery phrases.
Researchers are also monitoring suspicious cryptocurrency addresses, including one reportedly holding 211 BTC, for further movements linked to the suspected thefts. The estimated $86 million loss remains independently reported rather than officially confirmed by Ledger, while additional victim reports could change the figure.
Ledger’s investigation remains ongoing, with the attack method, number of affected customers, and total confirmed financial losses still undetermined.
Also Read: Nasdaq CEO Says Tokenization Could Unlock Billions in Global Collateral
The post What We Know About the $86 Million Ledger Drain So Far appeared first on 36Crypto.
