Ledger Supply Chain Attack Feared After $86M Drain, CryptoBilis Sales Paused

Ledger told anyone who bought from the Southeast Asian reseller in the past 90 days not to set up their device. Ledger has not said what caused the reported losses.

Ledger Supply Chain Attack Feared After $86M Drain, CryptoBilis Paused

Alexander Lux

09/10/26 · 2 minOctober 9, 2026 · 2 min read

Ledger asked CryptoBilis, one of its authorized resellers in Southeast Asia, to stop selling and shipping its hardware wallets on Oct. 9. Ledger says it is investigating reports that the reseller's customers lost funds.

The pause came as on-chain investigator Specter said wallets belonging to Ledger users had been drained of more than $86 million. A hardware wallet exists to keep a user's keys offline, away from thieves.

Ledger Tells Recent Buyers Not to Set Up Devices

In a post from its support account, Ledger said it is looking into losses reported by users in South East Asia who bought from CryptoBilis.

We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet.

Buyers who already set up a device should consider moving their coins to a new Ledger with a new seed, the company said. The seed is the recovery phrase that controls the wallet. Ledger has not said what caused the losses or whether the devices were at fault.

CryptoBilis appears on Ledger's official reseller list for Malaysia and Indonesia. A separate CryptoBilis PH store is listed for the Philippines.

Specter Traces Funds to 98 Addresses

Specter posted the tally about an hour before Ledger spoke, listing 10 theft addresses on Ethereum, Tron and Bitcoin. A screenshot of an Arkham dashboard in the post put the total at almost $87 million across 98 addresses, including about $42.2 million in ether and $17.6 million in bitcoin.

That count covers drain reports from Ledger users on X and Reddit, not only CryptoBilis buyers. Neither Ledger nor the reseller has confirmed a loss figure. One Reddit post in the screenshots came from a Ledger Stax owner, who said almost 100,000 USDT left a wallet whose recovery phrase was handwritten and kept in a safe.

Ledger says it will update customers as the investigation goes on.

It's still unclear how the funds left the wallets, and whether every victim bought from the same shop. Our read: wallets intercepted and sold with a preconfigured seed phrase.

Treat gambling as entertainment you pay for. 18+, and if it stops feeling like entertainment, help exists at BeGambleAware and GamCare.