On Tuesday, October 13, 2026, The Paypers reported that Ledger, the France-based hardware wallet maker, has opened an investigation into fund losses reported by users in Southeast Asia who bought devices from the reseller CryptoBilis.
Ledger has asked CryptoBilis to halt all sales and shipments of its devices while the review is under way. The company announced the request through its support account on X and described it as a precaution pending the outcome of the investigation.
The company advised anyone who purchased a device from CryptoBilis in the past 90 days not to set it up if they have not already done so. Customers who have already initialised their devices were encouraged to consider transferring their assets to a new Ledger signer created with a fresh seed phrase, the master backup from which a wallet’s private keys can be regenerated.
Ledger has not said what caused the losses or how many customers are affected. Hardware wallets are built to keep private keys offline, but that safeguard relies on the device being untouched before it reaches the buyer. A unit compromised before delivery, for instance, one shipped with a recovery phrase already known to an attacker, can leave funds exposed no matter how the owner later uses it. No tampering has been confirmed so far.
Early estimates put the losses in the tens of millions of dollars. Onchain investigator Specter, who is pseudonymous, said he traced theft addresses flagged by Ledger users on X and Reddit and found inflows from hundreds of victim wallets across the Ethereum, Tron and Bitcoin networks. Specter estimated total losses at more than USD 86 million.
Arkham data shared by the investigator shows nearly USD 87 million held at those addresses. That total includes about USD 42 million in ETH, USD 17.6 million in BTC, and USD 16.5 million in USDT. Ledger has not confirmed the figure, and it is unclear whether every theft is linked to the reseller.
The case has put the distribution chain for self-custody devices under scrutiny. Ledger’s competitor Trezor has faced its own security problems, including customer data exposed through a breach at a shipping partner and a breach of its email in September 2026.
The incident also follows several large security events in the crypto sector. In September 2026, Bitget lost about USD 387 million in a hack that investigators have attributed to North Korea. Blockchain analytics firms Chainalysis and Elliptic traced part of the stolen funds.
North Korean hackers also spent six months infiltrating the Solana-based exchange Drift before carrying out a USD 285 million exploit. Drift has since set out a plan to repay affected users. Separately, in September 2026, self-described white hat hackers withdrew USD 320 million in Bitcoin from Blockstream’s Liquid sidechain before entering negotiations with the company.
Ledger’s findings are expected to establish whether the reported thefts stem from devices sold through CryptoBilis and how many of the reseller’s customers have been affected.
Source: The Paypers
Be the first to comment