Ledger Says Wallet Cases Are Linked to CryptoBilis; Cause and Losses Remain Unclear
Ledger says the cases it has identified involve devices bought from CryptoBilis, an authorized reseller in Southeast Asia. Losses of more than $86 million have been reported, but that figure is unconfirmed. Investigators have not established whether the suspected thefts are connected or whether a reported hardware implant played any role.
- Ledger says the number of affected devices is “limited, ” but has not provided a count.
- Blockchain investigator Specter’s estimate of losses above $86 million is unverified.
- A reported implant was found on one customer’s device. Its function and any role in the thefts are unknown.
- Ledger says its systems and direct sales were not affected.
What Ledger Has Said
In an Oct. 11 update, Ledger said the cases it had identified involved devices purchased from CryptoBilis. The update followed reports on Oct. 9, 2026, that Ledger was investigating suspected thefts involving the reseller’s customers.
“The number of impacted devices is limited, ” Ledger said.
Ledger has not provided a precise count of affected devices, customers or wallets. Those numbers are not interchangeable. One customer could own multiple devices or wallets, and public estimates of suspected wallets do not show how many customers or devices were involved.
Ledger said its systems and direct sales were unaffected. That does not explain how the reported thefts happened or confirm that every device sold through a third party was safe. Ledger said it was working with the appropriate authorities and contacting affected customers. The reports available did not name the authorities.
The Loss Estimates Are Not Confirmed
CoinDesk attributed an estimate of more than $86 million in potential losses to Specter, a pseudonymous blockchain investigator. According to CoinDesk, Specter tracked suspected thefts involving hundreds of wallets across Bitcoin, Ethereum and Tron after seeing user reports on X and Reddit. The publication said the losses had not been independently confirmed, and it was unclear whether the incidents were connected.
Lookonchain also reported an earlier estimate from security researcher tanuki42 of more than $72 million, with the amount still rising. The figures may reflect changing estimates, but neither is a verified total. The wallets included in those estimates may also be a different set of cases from the devices Ledger has so far linked to CryptoBilis.
Ledger had previously reported finding an unauthorized hardware implant on one compromised customer’s device. The reports do not say whether “implant” means a physical component or another kind of modification, what it did or how it was found. They also do not show that it caused any theft or appeared on other devices.
CryptoBilis Paused Hardware-Wallet Sales
CryptoBilis halted sales of all hardware wallets until further notice, according to the Oct. 11 report. CoinDesk’s Oct. 9 account said Ledger had asked the reseller to pause sales and shipments. These reports describe steps taken in response. They do not say when sales might resume.
CoinDesk also reported that Ledger’s initial guidance applied to people who had bought from CryptoBilis in the previous 90 days. They were advised not to start setting up their devices. Customers who had already activated a wallet were advised to consider moving their assets to a new Ledger device with a newly generated recovery phrase. The Oct. 11 update did not say whether that advice had changed.
A recovery phrase is a set of words that lets you restore access to a wallet. Anyone who gets the phrase may be able to access the funds it controls. If the phrase may have been exposed, create a wallet with a genuinely new phrase and transfer the funds to an address controlled by that wallet. Replacing the device alone, or creating a new wallet without moving the funds, will not protect assets tied to a compromised phrase.
Available reports do not confirm that a compromised recovery phrase caused these thefts. CoinDesk described that as one possible supply-chain scenario, not a proven explanation.
Why Reseller Security Matters
A supply-chain attack compromises a product somewhere between manufacture and use, such as during distribution, storage or resale. That alone would not prove the manufacturer’s internal systems were breached. Ledger’s statement that its systems and direct sales were unaffected also does not explain what happened to devices handled by a reseller.
Ledger said it had strengthened supply-chain protections, including its authorized-reseller system, and improved hardware protections against physical tampering. It also reminded distributors to buy products only from authorized sources and not to resell returned devices. The company urged other hardware-wallet providers and security researchers to improve tamper protections, following a critical flaw discovered in a rival hardware wallet.
The reports provide no technical details about those changes, when they took effect or how they relate to the device with the reported implant. Until investigators identify the mechanism, claims that a particular safeguard would have prevented the thefts remain speculation.
The practical lesson is more specific than “hardware wallets are unsafe.” A device’s security depends on its design, how it is sourced and handled, and how it is set up. Buy through trusted channels, be wary of unexpected setup instructions and never share a recovery phrase. Hardware wallets can protect keys from many online threats, but they cannot make an exposed recovery phrase secret again.
Key Questions and Answers
-
What should CryptoBilis customers do?
Ledger’s initial guidance, reported by CoinDesk on Oct. 9, 2026, advised buyers from the previous 90 days not to start setting up their devices. Customers who had already activated a wallet were advised to consider moving their assets to a new Ledger device with a newly generated phrase. If a phrase may be compromised, create a wallet with a genuinely new phrase and transfer the funds to an address it controls. Changing devices alone is not enough.
-
How many devices or wallets were affected?
Ledger has not provided a precise count. It described the number of impacted devices as “limited.”
-
Were more than $86 million stolen?
No confirmed total has been established. Specter estimated potential losses above $86 million, but CoinDesk said the figure was not independently confirmed and that the suspected cases might not be connected.
-
Did Ledger’s systems get breached?
Ledger said its systems and direct sales were not affected. The cause of the reported thefts remains under investigation.
-
Did the reported implant cause the thefts?
That has not been established. Ledger reportedly found an unauthorized implant on one customer’s device, but its function and any connection to losses remain unknown.
