Ledger confirmed that all verified cases in the recent wallet-draining incident are linked to devices sold by Southeast Asian reseller CryptoBilis. In a 72-hour update released on Sunday, October 11, 2026, the Paris-based hardware wallet manufacturer stated that its own systems and direct sales channels remain unaffected. The company described the volume of impacted devices as "limited" and noted that it is cooperating with relevant authorities while reaching out to affected users. CryptoBilis has ceased all hardware wallet sales following the investigation.
The inquiry began on Friday after users in Southeast Asia reported losing funds from devices purchased through CryptoBilis. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron, and Bitcoin networks, though Ledger has not independently confirmed this total figure or identified the specific cause of the losses. Another firm, YFarmX, reported sending Ledger a list of over 450 drained wallets. Their analysis indicated the thief moved 2,810 ETH through Tornado Cash, utilized Zcash's shielded pool for withdrawals, and converted stolen USDT into USDD before moving funds to Binance deposit addresses. Tether froze 10 million USDT on the first day, but significant amounts of ETH, BTC, and USDD remain unrecovered. These findings have not been independently verified.
Separately, an X user named Johannes claimed to have found tampered Ledger devices in Europe, citing identical modifications such as additional cables and LTE modules. Ledger’s update reiterated that all confirmed cases so far involve CryptoBilis devices. The company advised authorized resellers never to restock returned products and warned consumers against buying from unauthorized sellers due to the risk of counterfeit or modified hardware. Ledger is reviewing supply-chain controls and advancing hardware protections.
This incident highlights the critical vulnerability of hardware wallet security when compromised at the distribution level rather than through software exploits. By isolating the breach to a specific reseller, Ledger attempts to contain reputational damage to its core manufacturing integrity, yet the scale of alleged losses—potentially exceeding $86 million—underscores the high stakes of supply-chain trust in the crypto ecosystem. The distinction between Ledger’s direct channels and third-party resellers becomes a primary factor in consumer risk assessment, shifting the burden of verification onto buyers who may lack technical expertise to detect physical tampering.
Regulatory and operational implications extend beyond immediate fund recovery. The use of mixers like Tornado Cash and privacy coins like Zcash complicates law enforcement efforts, demonstrating how illicit actors leverage existing blockchain infrastructure to obscure trails. For institutional investors and exchanges, this event serves as a stress test for counterparty risk associated with hardware vendors. It also pressures the industry to adopt stricter anti-tamper standards and transparent provenance tracking, as current models rely heavily on brand reputation rather than cryptographic proof of device integrity at the point of sale.
