A hardware wallet is supposed to be the part of your setup you don’t have to trust anyone about. On Friday, October 9, 2026, Ledger said it was investigating losses reported by users in Southeast Asia who had one thing in common: they bought their devices from the same authorized reseller, CryptoBilis.
On-chain investigators put the losses at more than $86 million across Ethereum, Tron and Bitcoin. Ledger says its own systems were not breached. The question that remains is what happened to the devices between the factory and the buyer.
Key facts
- On October 9, 2026, Ledger said it was investigating fund losses reported by users who bought devices from CryptoBilis and asked the reseller to pause sales pending the investigation.
- CryptoBilis is an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.
- Ledger told anyone who bought from CryptoBilis in the last 90 days not to set the device up, and those who already did to move funds to a new device with a new seed phrase.
- Investigator Specter estimated total losses at $86M+; Arkham counted nearly $87M at theft addresses, including about $42M in ETH, $17.6M in BTC and $16.5M in USDT.
- Ledger said its “infrastructure, systems and services were not compromised” and that it had no reports involving devices bought directly from Ledger.
What happened with Ledger devices sold by CryptoBilis?
Users in Southeast Asia who bought Ledger hardware wallets from the authorized reseller CryptoBilis reported their funds being drained. On October 9, 2026, Ledger opened an investigation, asked CryptoBilis to pause sales, and warned recent buyers not to use their devices. Tampered or counterfeit hardware is the leading suspicion, but nothing has been confirmed.
According to Decrypt, Ledger asked the reseller to stop selling “pending the results of our investigation.” Its guidance to customers was blunt: if you bought from CryptoBilis in the past 90 days, don’t initialize the device. If you already have, move your funds to a new device with a freshly generated seed phrase.
Ledger was equally clear about what it believes did not happen. As Cointelegraph reported, the company said “Ledger’s infrastructure, systems and services were not compromised,” and it had seen no reports involving devices bought directly from Ledger.
How much was stolen?
Estimates converge around $86–87 million, though no figure is final. On-chain investigator Specter put “total losses $86M+” across Ethereum, Tron and Bitcoin. Arkham counted nearly $87 million sitting at theft addresses. One later tally reported $93.2 million from 315 wallets across six networks by October 10, but that figure is unconfirmed.
| Asset (Arkham) | Approx. value at theft addresses |
|---|---|
| ETH | ~$42M |
| BTC | $17.6M |
| USDT | $16.5M |
| Total (all assets) | nearly $87M |
Researcher tanuki42 tied eight addresses to more than $72 million and was careful about the link to the reseller: “Not with certainty, but I’m not aware of a victim report which does not involve this reseller.” Around $270,000 in USDT and TRX moved to Binance. Changpeng Zhao suggested counterfeit or tampered devices and said the industry should “help trace and recover the funds.”
The hidden-modem claim
The most striking claim came from Mark Karpelès, who reportedly said he found an LTE module, antenna, eSIM and microcontroller hidden under the screen padding of a shrink-wrapped Ledger bought in Malaysia. Ledger has not confirmed any connection to the CryptoBilis losses, and that report should be treated as unverified until the investigation concludes.
Your keys are only as safe as the box they came in.
Is my hardware wallet safe if I bought it from a reseller?
Most likely, but the CryptoBilis case shows why the supply chain matters. Ledger says devices bought directly from it are not affected and its systems were not breached. If you bought from CryptoBilis in the last 90 days, follow Ledger’s guidance: don’t set the device up, or move funds to a new device with a new seed.
For anyone else, a few checks reduce the risk of a tampered unit:
- Buy from the manufacturer where possible. A reseller adds a link to the chain you can’t inspect.
- Never accept a pre-generated seed. A genuine device creates its recovery phrase on first setup. A card with words already printed on it is a red flag.
- Use the vendor’s own genuineness check in its official app before loading funds.
- Test with a small amount first, and watch the address for a few days before moving savings.
None of these is a guarantee against sophisticated hardware tampering. Together they make the cheap attacks much harder. Our guide to cold storage options and our list of best Bitcoin wallets cover the trade-offs in more detail.
What it means for swap users
A swap is only as safe as the address it pays out to. SwapZilla is non-custodial: there is no account and no balance, and each swap sends the output directly to the wallet address you enter. That means the security of that destination wallet is entirely yours. If you bought a device from CryptoBilis recently, don’t use its addresses as a payout or refund address until you’ve moved to a new device and seed. For a quick refresher on the flow, see how SwapZilla works; you can follow any swap’s status on the tracking page.
Why does a reseller attack matter for self-custody?
Self-custody removes one kind of risk — an exchange freezing or losing your funds — and replaces it with another: you are responsible for every link in your own chain, including where the hardware came from. The CryptoBilis case targets exactly that link, and it scales: one compromised distributor can reach hundreds of wallets.
It also arrives a month after a different hardware-wallet scare in which phishing emails were sent through a breached email provider used by Trezor, covered in our report on the fake Trezor and BitBox alerts. The attack surface keeps moving away from the chip itself and toward everything around it: email lists, resellers, packaging.
Final thoughts
Ledger’s October 9 investigation is still open, and the exact mechanism behind the $86M+ in losses hasn’t been confirmed. What is clear is the pattern: victims tied to one authorized reseller, no reports from direct purchases, and Ledger’s own systems reportedly intact.
The lesson is old and still underrated. A hardware wallet is a security device, and a security device you didn’t get from the source is one you have to verify yourself. If in doubt, generate a new seed on hardware you trust — before the funds move, not after.