Hardware wallet probe follows $86M user losses

TLDR

Ledger hardware wallets tied to a Southeast Asian reseller are being investigated after on-chain analysts flagged more than $86 million in suspected user losses.

1. Ledger is probing reports that hundreds of wallets drained across Bitcoin, Ethereum and Tron are linked to devices sold by reseller CryptoBilis.
2. Early evidence points to a localized supply-chain or reseller issue, not a confirmed global Ledger device or firmware flaw, but the attack vector remains unclear.
3. Hardware wallet users should review where they bought their device, follow Ledgers guidance, and watch for further technical and law-enforcement updates.

Deep Dive

1. What Happened To Users Funds?

Ledger is investigating reports that customer funds were stolen from hardware wallets bought through Southeast Asian distributor CryptoBilis, with on-chain analysts estimating losses above $86 million across multiple chains as of 9 Oct 2026. Investigators including Specter traced flows from hundreds of victim wallets on Bitcoin, Ethereum and Tron into a cluster of receiving addresses, with one Bitcoin address alone holding more than 211 BTC that had not moved at the time of analysis. Ledger asked CryptoBilis to pause all sales and shipments and warned buyers from the past 90 days not to initialize devices, or to migrate assets to a new device with a new recovery phrase if they already had set them up, as described in several reports on the incident such as this overview.

2. Localized Supply-Chain Risk Or Global Flaw?

So far, neither Ledger nor independent researchers have confirmed how funds were drained, whether devices were tampered, or whether there is a previously unknown hardware or firmware vulnerability. Coverage such as bitcoin.coms summary and a Yahoo Finance report note that losses appear concentrated among recent buyers from one reseller, which supports a working hypothesis of a localized supply-chain or fake-device issue rather than a universal flaw in all Ledger units. Industry voices, including Binances former CEO, have emphasized that there is no evidence yet of a broader Ledger vulnerability, but also that prior incidents with other hardware wallets show physical tampering and seed-generation bugs can be catastrophic when they occur.

3. What Hardware Wallet Users Should Do And Watch

For anyone who bought a Ledger from CryptoBilis in roughly the last 90 days, Ledger explicitly advises not to initialize unused devices and to move funds to a freshly set up device with a new recovery phrase if already in use. For other hardware wallet users, the practical lessons are to purchase only through official channels, be wary of sealed devices from third-party marketplaces, and never reveal recovery phrases or PINs to software or people outside the manufacturers documented process. The key signals to monitor now are Ledgers technical findings, any recall or firmware-update notices, movement from the flagged attack addresses, and confirmation of whether law-enforcement agencies are treating this strictly as reseller fraud or as a product-level security incident.

Conclusion

The probe into more than $86 million in suspected losses shows that cold storage is only as safe as the hardwares supply chain and the secrecy of recovery phrases. For crypto users, the immediate priority is verifying device provenance and following Ledgers guidance, while the longer term takeaway is to treat hardware-wallet purchases and data leaks as part of a broader security surface, not a solved problem.