On 9 October 2026 Ledger said it was investigating reports of lost funds from people in Southeast Asia who had bought its hardware wallets from a reseller named CryptoBilis. It asked that reseller to pause sales and shipments. Buyers from the past 90 days were told not to initialise a device that was still in the box, and, if they already had, to consider moving assets to a new Ledger signer with a newly generated recovery phrase. Ledger told Cointelegraph the same day that its infrastructure, systems, and services were not compromised, and that it had no reports involving devices bought directly from the company. The cause was not public yet. A cause that is still under investigation is not a chip failure, and it is not a reason to type a recovery phrase into a website that claims it can check.
CryptoBilis was listed as an authorised Ledger reseller in Indonesia, Malaysia, and the Philippines. Authorised means a contract with the vendor. It does not mean every box on that shop’s shelf left the factory and stayed shut. On-chain researchers put suspected losses that day somewhere above $72 million and above $86 million. Those were estimates. Ledger did not confirm a dollar total on 9 October, and it still had not confirmed one when it described the mechanism four days later.
What happened
A hardware wallet is a small computer that is supposed to keep keys off the laptop. The recovery phrase is the backup of those keys. Anyone who sees the phrase during setup does not need to break the chip afterwards. They can restore the same wallet somewhere else. Hardware wallets are a practice, not a shopping list, and the practice includes which shop handed you the brick. The 2020 Ledger incident was a shop database of names and emails. The January 2024 Trezor incident was a helpdesk. The August 2026 Trezor incident was a parcel company’s address list. None of those moved coins by themselves. This one did, for people who set up a device from one reseller.
Update, 13 October. Ledger said it had confirmed an unauthorised part inside at least one device sold by CryptoBilis. The company’s public account is that the part sat in the enclosure, read the recovery phrase off the device’s own setup screen, and sent those words out over a mobile network. It did not, in that account, modify the Secure Element, the operating system, or the way the device signs a transaction. Ledger said every confirmed loss in the 9 October incident involved a CryptoBilis device, and that it had not verified a theft from a signer bought elsewhere. It was still looking at other reports. We will not describe the part, the radio, or how a box is opened. The customer lesson does not need a diagram.
The same day Ledger asked authorised resellers and distributors to suspend sales in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong, and to take devices off open shelves. It said returned devices must not be resold. CryptoBilis had already paused Ledger sales, and said it was pausing all hardware-wallet brands in Malaysia, the Philippines, and Indonesia while it reviewed its own process. Researcher tallies by 12 October, including Bitquery’s $93.2 million across 315 wallets and a higher YFarmX figure near $94.5 million, are still researcher tallies. Tether froze about $10 million of USDT tied to the tracing. A freeze is an issuer switching off its own tokens. It does not rewind bitcoin.
Why it matters
If you bought a Ledger from Ledger, or from a shop Ledger has not named, this page is not a recall of every device on earth. If you bought one from CryptoBilis in the 90 days Ledger named, the company’s instruction is the one to follow: do not set up an unused unit, and if you already generated a phrase on one, treat that phrase as exposed and move to a new phrase on a device you can account for. Restoring the old words onto the new device recreates the same keys. That is the same hygiene as the D’CENT app-wallet drain. A phrase that has been seen is no longer a backup. It is a copy.
Phishing will wear Ledger’s logo and ask you to “verify” the twenty-four words so a replacement can be shipped. Nobody legitimate needs those words. Not support, not a reseller, not a form. See a practical checklist for keeping crypto safer. See how crypto wallets actually work: the network holds the coins, the phrase is the proof you may move them, and a tampered box is a third party who watched you write the proof down.
Trezor said it had found no evidence its own devices were touched, and that it would end some reseller authorisations on 1 January 2027. That is a different company tightening a shop list. It is not a finding that every hardware wallet in a drawer is compromised, and it is not a league table.
What happens next
Ledger said the investigation was still open on where in the distribution chain the devices were altered, and that it would publish more when it could. Sales in the named markets stay paused until that work says otherwise. More researcher totals will circulate. Treat a number Ledger has not signed as a number Ledger has not signed. A later arrest, if one comes, is a criminal case. It does not patch a phrase that was already read.
Not a review of Ledger or Trezor. Not an instruction to buy a brand, dump a brand, or type a recovery phrase into a page that hurried you. If your phrase never left a device you bought from a channel you can name, this incident is someone else’s box.
