Ledger is investigating reports that customers in Southeast Asia lost cryptocurrency after buying hardware wallets from reseller CryptoBilis, and has asked the retailer to stop selling and shipping its devices while the inquiry continues.
The Paris-based wallet maker said on October 9 that buyers who purchased a Ledger device from CryptoBilis during the previous 90 days should not set it up if they have not already done so. Customers who have activated such a device were advised to consider transferring their assets to a new Ledger signer using a newly generated seed phrase.
A seed phrase is the master backup that can recreate a crypto wallet’s private keys. Anyone who obtains it may be able to access the assets controlled by that wallet. Ledger has not said that the devices were tampered with, however, and it has not identified the cause of the reported losses.
What Ledger has confirmed
Ledger said its investigation follows reports from users in Southeast Asia who bought products through CryptoBilis. As a precaution, the company said it asked the reseller to pause all sales and shipments of Ledger devices pending the outcome of the investigation.
The company has not disclosed how many customers may be affected or confirmed the value of the losses. It also has not established whether every reported theft is connected to CryptoBilis.
The warning applies particularly to devices bought from the reseller in the past 90 days. Customers who have not yet initialized their device have been told to wait. Those who have already done so were advised to move funds to another Ledger signer with a fresh seed phrase, rather than continuing to rely on the potentially affected wallet.
Hardware wallets are intended to keep private keys offline, reducing the risks associated with storing those keys on an internet-connected device. But the security of a wallet can be undermined if a device is compromised before delivery—for example, if it were supplied with a recovery phrase already known to an attacker. Ledger has not confirmed that this occurred in the CryptoBilis case.
According to Decrypt, the company’s support account made the warning public on X as it began investigating the customer reports.
Blockchain investigator estimates losses
The possible scale of the incident is much larger than the number of individual complaints initially visible online may suggest. Pseudonymous onchain investigator Specter said they followed theft addresses identified in reports from Ledger users on X and Reddit.
Specter said those addresses received funds from more than hundreds of victim wallets across Ethereum, Tron and Bitcoin. The investigator estimated total losses at more than $86 million. Data from Arkham cited by Specter showed almost $87 million at the addresses, including approximately:
- $42 million in ETH;
- $17.6 million in BTC; and
- $16.5 million in USDT.
Those figures remain an external estimate, not a confirmed Ledger total. The wallet maker has not verified the amount, and the available information does not establish that every transaction included in the estimate resulted from the CryptoBilis-related reports.
The use of several major blockchains also means the suspected thefts involve different types of cryptoassets and transaction networks. Onchain investigations can identify transfers to publicly visible addresses, but linking every address or movement to a particular incident still requires confirmation from the affected users and the companies involved.
A wider security problem for crypto users
The Ledger investigation comes during a period of heightened concern over cryptocurrency security. Hardware wallets are often used by people who want to hold their private keys away from online services, but the CryptoBilis reports highlight the importance of the supply chain and the setup process as well as the device itself.
Rival wallet maker Trezor has also faced security-related problems, including customer information exposed through a shipping-partner breach and an email breach reported last month. Those incidents involved different circumstances, but they add to the security pressures facing providers of crypto storage products.
Other major incidents cited in the reporting include the loss of roughly $387 million from Bitget in a hack that investigators have linked to North Korea. Tracking companies Chainalysis and Elliptic have traced part of that haul. North Korean hackers were also reported to have spent six months infiltrating Solana exchange Drift before a $285 million exploit; Drift subsequently outlined a plan to repay users.
In September, self-described white-hat hackers withdrew $320 million in Bitcoin from Blockstream’s Liquid sidechain before negotiating with the company.
For Ledger customers potentially affected by the CryptoBilis issue, the immediate message is precautionary rather than conclusive: stop using or setting up the relevant device until more is known, and use a new device and seed phrase when moving assets if the original wallet has already been initialized. Ledger’s investigation will need to determine whether the reported losses share a common cause and how much cryptocurrency, if any, can be directly tied to the reseller.
Moneyiar market picture
Moneyiar market data at 11:48–11:49 a.m. on October 11, 2026, showed mixed performance among the listed assets:
- Celestia (TIA) was priced at $0.5839784847, up 19.91% over 24 hours and 24.19% over seven days.
- OriginTrail (TRAC) was at $0.4059202201, up 0.11% over 24 hours but down 9.72% over seven days.
- edgeX (EDGE) stood at $0.3511507321, down 3% over 24 hours and 25.65% over seven days.
- Ailey (ALE) was priced at $0.2679301463, unchanged over 24 hours and down 0.6% over seven days.
