Ledger is investigating reports that cryptocurrency worth more than $86 million may have been stolen from hundreds of wallets associated with hardware devices sold by CryptoBilis, a Southeast Asian reseller. The reported losses have not been independently verified, and the hardware-wallet maker has not confirmed that the incidents are connected or established how the funds disappeared.
According to CoinDesk, the reports involve suspected transfers from Bitcoin, Ethereum and Tron addresses. The claims were brought to wider attention by pseudonymous blockchain investigator Specter, who said on X that they had traced addresses linked to the suspected thefts after seeing complaints from Ledger customers on X and Reddit.
Ledger has acknowledged reports from customers who bought devices through CryptoBilis but has not endorsed the reported $86 million figure. The company also has not identified a confirmed technical cause, the number of affected users or the total amount of cryptocurrency that may have been lost.
Ledger asks reseller to stop sales
As a precaution, Ledger said it asked CryptoBilis to suspend sales and shipments while the investigation proceeds. Customers who bought devices from the reseller during the previous 90 days were advised not to start setting them up.
Customers who have already activated wallets connected to those devices were told to consider moving their assets to another Ledger device and generating a new recovery phrase. A recovery phrase is a set of words used to restore access to a cryptocurrency wallet. Anyone who knows it may be able to control the assets held in that wallet, making the generation and handling of the phrase a central security step.
Ledger’s guidance does not establish that every device sold by CryptoBilis was compromised. Rather, it reflects the company’s effort to limit potential exposure while it examines the reports. Ledger said it would provide further updates as the investigation develops.
Supply-chain tampering is one possibility
One explanation under consideration is a supply-chain attack. In such an attack, a product may be altered before it reaches the customer. For a hardware wallet, a particularly serious form of tampering could involve a device being supplied with a recovery phrase already known to an attacker. If a customer later deposits cryptocurrency into a wallet controlled by that phrase, the attacker could potentially access the funds.
That scenario would be different from a breach of Ledger’s own systems or a failure in its wallet technology. At present, however, there is no confirmation that devices were tampered with, that pre-generated recovery phrases were used or that Ledger’s systems were compromised.
Ledger, founded in 2014 and headquartered in Paris, makes hardware wallets designed to keep the private keys used to access cryptocurrency offline. The company says it has sold more than 7 million devices worldwide. Its products are widely used by people seeking to hold cryptocurrency without leaving assets on an exchange.
Because of that broad user base, a confirmed security problem involving products sold under the Ledger name could have implications beyond the customers who purchased through CryptoBilis. The current investigation is specifically focused on devices distributed by a third-party reseller, and the available information does not establish that the issue extends to Ledger’s wider product network.
Wider crypto-security backdrop
The suspected theft comes during a difficult period for cryptocurrency security. The source material cites DefiLlama figures showing that last month’s exploit at crypto exchange Bitget resulted in more than $350 million in stolen assets. Other major incidents listed were the Liquid Network, at about $320 million, Drift, at $295 million, and Kelp, at $293 million.
Those figures provide context for the potential scale of the Ledger-linked reports, but they do not verify the claims in this case. The amount attributed to the suspected wallet theft remains an estimate from an outside investigator, and the relationship between the reported transactions has not been independently confirmed.
Important questions therefore remain open:
- How many users were affected?
- Were the reported thefts connected to one another?
- Were the devices altered before reaching customers?
- What was the actual amount of cryptocurrency lost?
Until Ledger completes its investigation, the cause and scope of the incident remain uncertain.
Current market picture
Moneyiar market data at 11 October 2026, around 11:33-11:34 a.m. +03:30, showed Bitcoin at $82,969.46, up 0.28% over 24 hours but down 2.74% over seven days. Ethereum was $2,499.42, up 0.25% in 24 hours and down 7.50% over seven days.
TRON’s TRX token was trading at $0.3304, down 0.17% over 24 hours and 1.71% over seven days. Solana was $109.35, down 0.13% over 24 hours and 9.92% over seven days. These market movements do not establish any connection with the reported Ledger-related wallet losses; they are provided as a snapshot of prices and performance at the stated time.
