Ledger is investigating reports that hardware wallets sold through CryptoBilis, a Southeast Asian reseller, may have been compromised before delivery, resulting in suspected theft of $86 million in cryptocurrency from hundreds of users.
The hardware wallet maker acknowledged the reports on October 9, 2026, and announced a formal investigation into the alleged supply-chain attack. Pseudonymous blockchain investigator Specter traced suspected theft addresses across Bitcoin, Ethereum, and Tron blockchains after identifying reports from Ledger users on X and Reddit.
Ledger advised customers who purchased devices from CryptoBilis within the last 90 days not to set up those devices. For users who had already activated wallets from CryptoBilis, Ledger recommended transferring all assets to a new device with a newly generated recovery phrase. The company also asked CryptoBilis to halt all sales and shipments pending the investigation’s completion.
How a Supply-Chain Attack Could Work
A supply-chain attack on hardware wallets could involve pre-generated recovery phrases known to attackers before the devices reach customers. Such a mechanism would allow attackers to access funds after customers deposit cryptocurrency into the wallets, bypassing the device’s security model entirely.
This incident differs from a breach of Ledger’s own systems. The investigation focuses on whether devices were tampered with during the resale distribution chain in Southeast Asia.
2026’s Escalating Security Losses
The suspected $86 million loss adds to a year marked by major cryptocurrency security incidents. Bitget suffered a $350 million exploit last month. Other significant losses this year include Liquid Network at $320 million, Drift at $295 million, and Kelp at $293 million, according to data tracked by DefiLlama.
The connection between the reported CryptoBilis thefts and other 2026 security incidents remains unclear. The $86 million figure and the extent of device tampering have not been independently verified. Ledger did not specify the total number of affected users or confirm whether device tampering definitively caused the reported losses.
