Ledger Investigates $86M Crypto Drain Tied to Southeast Asian Reseller CryptoBilis

Published October 9, 2026, 21:00 UTC. First reported by Ledger's official support account on X; loss estimates from onchain investigators Specter and tanuki42; additional reporting from The Block, CoinDesk, Cointelegraph, Protos and Gizmodo.

Ledger is investigating reports that cryptocurrency holders who bought its hardware wallets from a reseller in Southeast Asia have lost their funds, in what onchain researchers estimate could be an $86 million theft. The company announced the probe in an X post on October 9 and told the reseller, CryptoBilis, to halt all sales and shipments of Ledger devices while the investigation continues.

The 90-day buyer warning

Ledger's support account advised customers who bought from CryptoBilis in the past 90 days not to begin setting up their devices. Those who have already activated their wallets should consider moving their assets to a new Ledger signer with a newly generated recovery phrase, the company said. "We will continue to inform customers of updates as the investigation progresses," Ledger's support account wrote. CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia and the Philippines.

The $86 million estimate

The widely cited loss figures come from pseudonymous onchain investigators. Specter said on X that he traced suspected theft addresses across Bitcoin, Ethereum and Tron after seeing reports from Ledger users, and identified inflows from hundreds of victim wallets, putting total losses above $86 million. Fellow researcher tanuki42 identified eight addresses allegedly connected to more than $72 million in stolen cryptocurrency. Separately, Arkham Intelligence's unverified custom entity labeled ledger-drainer showed about $71.5 million still sitting in flagged addresses on Friday afternoon, including roughly $29.4 million in ether, $17.5 million in bitcoin, $13.6 million in USDD and $10.8 million in USDT, according to Gizmodo. Ledger has not confirmed any of these estimates, and the exact connection between the flagged addresses and the CryptoBilis probe remains unestablished.

Ledger says its own systems were not breached

Ledger's main account said the drained funds appear to be limited to devices sold through CryptoBilis in Southeast Asia, and that the company has no indication its security infrastructure, systems or services were compromised. In a statement to Cointelegraph, Ledger said the incident appeared isolated to the reseller and the affected market, adding that it had received no reports involving devices purchased directly from the company.

A supply-chain question with no confirmed answer

The cause of the losses is unconfirmed. A supply-chain attack involving tampered devices is one possible explanation, but the cause, the number of affected users and the total losses remain unverified, CoinDesk reported. Ledger has not accused CryptoBilis of tampering with anything, and nothing public has shown the reseller altered devices. CryptoBilis, which describes itself as an authorized Ledger reseller in Malaysia and also sells Trezor, OneKey, Tangem and SafePal hardware, had not issued a public statement as of Friday afternoon, according to Gizmodo and Protos. Crypto security organization Security Alliance urged potential victims whose funds reached the identified addresses to contact its incident-response team. Former Mt. Gox CEO Mark Karpeles highlighted that Ledger wallets sold by resellers have previously been found tampered with and implanted with spyware, Protos reported.

This article is news reporting and is not investment advice.

Sources

• Ledger (@Ledger_Support), official statement on X (Oct. 9, 2026), primary source
• The Block, Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses (Oct. 9, 2026), secondary source
• CoinDesk, Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen (Oct. 9, 2026), secondary source
• Cointelegraph, Ledger Warns CryptoBilis Buyers Amid Crypto Loss Reports (Oct. 9, 2026), secondary source
• Gizmodo, Ledger's Crypto Wallets Reportedly Backdoored, $71 Million in Crypto Already Moved (Oct. 9, 2026), secondary source