Ledger is investigating reported crypto losses exceeding $80 million linked to Southeast Asian reseller CryptoBilis. Customers are being urged to take precautions.
Ledger is investigating reports of cryptocurrency losses exceeding $80 million involving customers who purchased hardware wallets through CryptoBilis, a reseller operating in Southeast Asia.
The investigation has raised questions about hardware wallet security and the risks associated with third-party distribution channels. Ledger has asked CryptoBilis to suspend all sales and shipments while it examines the incident.
Ledger Confirms Investigation Into CryptoBilis
On October 9, Ledger Support confirmed that it was investigating reports of missing funds from customers in Southeast Asia who purchased devices through CryptoBilis.
The company advised affected customers to take precautions while the investigation remains ongoing.
Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…
— Ledger Support (@Ledger_Support) October 9, 2026
On-Chain Investigators Track More Than $80 Million
Blockchain analytics platform Arkham reported that more than $80 million in cryptocurrency had reportedly been taken from Ledger users across Bitcoin, Ethereum and TRON.
The exact amount of losses and the number of affected customers have not been independently confirmed. The cause of the incident also remains under investigation.
Ledger Drainer $80M Theft – Now on Arkham
Over $80M has reportedly been taken from Ledger users this week, across Bitcoin, Ethereum and Tron. Ledger is investigating. The cause is not confirmed.
Track the drainer on Arkham: pic.twitter.com/en3hAtmoOH
— Arkham (@arkham) October 9, 2026
Alleged Hardware Wallet Tampering Raises Concerns
The incident took another turn after photos of a disassembled Ledger device circulated on X. Mark Karpelès subsequently posted about an alleged spy SIM chip, raising questions about possible hardware tampering.
This is the spy SIM card, a 2x2mm chip, making it a bit of a pain to tap. More details to come (provider, etc). pic.twitter.com/usarC9Lpyp
— Mark Karpelès (@MagicalTux) October 9, 2026
The claims have not been conclusively verified, and the photographs alone do not establish that the alleged modifications caused the reported losses. Ledger has yet to confirm a connection between the pictured hardware and the incident.
CryptoBilis was reportedly listed as an authorized Ledger reseller serving Malaysia, Indonesia and the Philippines. Its reported reseller status has prompted further questions about supply-chain oversight, although it does not establish who currently controls the business or prove wrongdoing.
What Should Ledger Users Do?
Ledger advised customers who purchased devices from CryptoBilis within the previous 90 days to take precautions.
Customers who have not initialized their devices should follow Ledger’s latest guidance before proceeding. Those who have already set up their devices should consider moving their assets to a new Ledger signer with a newly generated recovery seed, as recommended by the company.
Users should never share their recovery phrases with anyone claiming to offer support. For further instructions, visit Ledger’s official support website.
Investigation Ongoing
Ledger has acknowledged the reports and requested that CryptoBilis pause sales and shipments. The precise cause of the losses, the number of affected customers and the role of the allegedly modified devices remain unclear.
The incident highlights the importance of hardware wallet security, trusted distribution channels and careful verification of security claims.
CoinDisc will continue to monitor the investigation as more verified information becomes available.
