Ledger, the French maker of crypto hardware wallets, says it is investigating reports that customers in South East Asia who bought its devices from a reseller called CryptoBilis have lost funds. It has asked that reseller to stop selling and shipping Ledger devices while it investigates. Loss totals of about $86 million are circulating, but they come from a security firm and an on-chain analyst, not from Ledger, and nobody has confirmed what caused the losses.
Spotted via Specter (@SpecterAnalyst) on X. Specter’s post goes further than Ledger: it gives a loss total and lists wallet addresses it calls theft addresses. Ledger has published neither.
What Ledger has confirmed
Confirmed. In a post from its verified Ledger Support account at 14:32 BST on Friday 9 October, the company said: “Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis.” [1] (Ledger spells the name with a double “l” there and “CryptoBilis” in the next sentence; the reseller’s own site uses CryptoBilis.)
It went on: “As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.” [1]
Ledger’s own guidance to buyers
Confirmed (company guidance, quoted in full). Ledger’s post says: “We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed).” [1] A “seed” is the recovery phrase that controls a wallet. Ledger adds that it “will continue to inform customers of updates” and asks people with questions to contact its support “through official channels” at support.ledger.com [1].
That is Ledger’s advice, limited to people who bought from this one reseller in the last 90 days. TSN adds nothing to it and gives no financial advice.
The loss figures, and who is making them
Unconfirmed. None of these numbers comes from Ledger.
- Hacken, a blockchain security firm, posted at 14:33 BST: “Users reported that wallets have been drained for ~$86M. Incident is under investigation by our security team.” [2] That is Hacken relaying user reports, with its own work still under way.
- Specter, a pseudonymous on-chain analyst, posted at 13:24 BST, about an hour before Ledger’s statement, that there had been reports on X and Reddit of wallet-draining among Ledger users. Specter said it traced “inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin”, with “Total losses $86M+” [3]. That is the analyst’s own tracing, and TSN has not checked it.
The two figures roughly agree, but neither has been confirmed by Ledger or by any authority. Nor has the number of people affected.
What Ledger has and has not said
TSN last checked Ledger’s channels at 15:06 BST on 9 October: the Ledger Support and main Ledger accounts on X (read via the X API), the ledger.com blog, Ledger’s support site and its status page [1][4][5]. At that point Ledger’s only public statement on the matter was the 14:32 Ledger Support post. The main @Ledger account had posted nothing about it, and none of those web pages mentioned CryptoBilis.
Ledger has said: it is investigating reports of lost funds among South East Asia buyers from CryptoBilis; it has asked CryptoBilis to pause all sales and shipments; and buyers from that reseller in the last 90 days should follow the guidance above.
Ledger has not said: how much was lost; how many customers are affected; what caused the losses; or whether its devices, its software or the reseller channel were compromised in any way. Some posts online have called this a “Ledger hack” or a supply-chain attack. Ledger has said neither, and TSN does not use those labels.
What this does not prove
- That Ledger’s devices or software were breached. Ledger has not said what caused the losses, and its investigation is open [1].
- That $86 million was lost. That figure is Hacken’s relay of user reports and Specter’s own tracing, both unconfirmed [2][3].
- That every CryptoBilis buyer is affected. Ledger’s guidance is precautionary and covers purchases from that reseller in the last 90 days [1].
- Anything about other resellers or other regions. Ledger’s statement names only CryptoBilis and South East Asia [1].
The Bottom Line
Ledger has confirmed an investigation and a pause on one reseller’s sales, and has told that reseller’s recent customers what to do. The $86 million figure and the cause are still unconfirmed, and this is a fast-moving story. TSN will update this post when Ledger publishes its findings.
Sources
- Ledger Support (@Ledger_Support, verified), X post, 9 October 2026, 14:32 BST (read in full via the X API; primary statement). https://x.com/Ledger_Support/status/2108551100613714002
- Hacken (@hackenclub), X post, 9 October 2026, 14:33 BST (read via the X API; relays user reports, unconfirmed). https://x.com/hackenclub/status/2108551383930564868
- Specter (@SpecterAnalyst), X post, 9 October 2026, 13:24 BST (read in full via the X API; first seen here). It goes beyond Ledger’s statement by giving a “$86M+” total, saying victims span Ethereum, TRON and Bitcoin, and listing addresses it calls theft addresses; none of this is confirmed by Ledger. https://x.com/SpecterAnalyst/status/2108534068564373687
- Ledger, blog, support site and status page, checked 9 October 2026 (no post on this incident found at the time of checking). https://www.ledger.com/blog ; https://support.ledger.com/ ; https://status.ledger.com/
- Ledger (@Ledger), X account, recent posts read via the X API, 9 October 2026. https://x.com/Ledger
- The Defiant, “Ledger Asks CryptoBilis to Halt Sales Amid Reports of Lost Funds”, 9 October 2026 (headline and standfirst only; reported). https://thedefiant.io/news/hacks/ledger-asks-cryptobilis-to-halt-sales-amid-reports-of-lost-funds
