As much as $93.2 million in cryptocurrency may have been stolen from wallets linked to Ledger devices sold by reseller CryptoBilis. Blockchain analysis firm Bitquery traced the funds across several networks, while Tether froze $10 million in USDT linked to the theft. Ledger said investigations were continuing, but the full extent of the incident has not yet been confirmed.
Bitquery reported that the attackers took mainly USDT and TRON tokens from 315 wallets across six blockchains. Security research platform YFarmX estimated a higher figure of $94.5 million, based on activity involving 521 addresses across seven blockchains. These figures come from blockchain data and should not be treated as a confirmed total loss announced by Ledger.
72 hour update on reseller CryptoBilis incident 🔽
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.
We take the CryptoBilis situation seriously and are actively investigating.We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets.
We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.
Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.
We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts.
This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users.
We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem. If you have relevant information, contact security@ledger.com.
For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger. If you have concerns that your device was impacted by the CryptoBilis incident, please contact Ledger Support through the official site: https://t.co/JUcWwJO9iF.
Ledger Support is available 24/7 to answer your questions and concerns.
Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase.
— Ledger (@Ledger) October 11, 2026
Ledger confirmed that an unauthorised hardware implant had been found in at least one affected device. However, the company has not explained whether the stolen wallets were compromised through the same method or how the devices were tampered with.
The freezing of $10 million in USDT is significant because stablecoin issuers such as Tether can block certain tokens linked to suspected criminal activity. Bitcoin and Ether generally cannot be frozen in the same way. Bitquery said around $81 million could still be traced on the blockchain as of October 11, while some funds had moved through Tornado Cash and Zcash.
The CryptoBilis investigation continues. This is a complex investigation, and as CEO, I am leading it with my Executive team. We are dedicating time and resources to explore every aspect to protect @Ledger users and find the malicious actors. Ledger and I will continue to communicate only facts we can validate through authorized channels.
All confirmed fund losses connected to the incident disclosed on October 9th involve Ledger signers sold through CryptoBilis, a reseller in Southeast Asia. On October 10th, Ledger confirmed that one affected signer contained an unauthorized hardware implant. We have no indication that Ledger’s infrastructure, systems or services were compromised. CryptoBilis has confirmed it stopped selling Ledger signers. The investigation is ongoing to determine who tampered with these signers or where in the distribution chain it happened. The @DonjonLedger will be examining the signers we receive, and Ledger Support is reviewing user reports to establish this.
We are reaching out to affected users and working with law enforcement. If you bought a Ledger signer from CryptoBilis and have not set it up, do not set it up. If you have set it up, transfer your assets promptly to a new signer with a new recovery phrase.
Do not send your signer to anyone before speaking with Ledger Support or local law enforcement, especially if you lost funds. Ledger will never call you, message you directly or ask for your 24-word recovery phrase.
Physical supply chain tampering is a risk for the whole industry. We are reviewing the controls that apply to our direct sales and to resellers, and we will share what we can. We are asking researchers and other vendors to work with us on chain-of-custody and tamper-detection practices. The Donjon’s analysis is ongoing and will continue as we receive signers. Thank you to the users who contacted us through official channels.
Some claims and figures circulating online are unverified. Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels for updates.
— Pascal Gauthier @Ledger (@_pgauthier) October 13, 2026
The incident has also raised questions about the responsibility of Ledger, because CryptoBilis had been listed as an authorised reseller on Ledger’s website. Some users have criticised the company and called for it to take greater responsibility.
Ledger advised customers who bought devices from CryptoBilis not to set up any unused devices. Those who had already used one were advised to move their assets to a new device with a newly generated recovery phrase.
This incident is different from a phishing campaign reported in April, when a fake Ledger Live app on Apple’s App Store led to losses of at least $9.5 million. In the latest case, the attacker appears to have obtained the keys needed to drain hundreds of wallets.
The investigation is still under way. Ledger has not confirmed the final amount lost or announced whether affected customers will receive compensation.
Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV
You need to login in order to Like
Leave a comment