- Trending
- Comments
- Latest
Ledger is investigating reports that users who bought hardware wallets from a Southeast Asian reseller have lost funds, with on-chain investigator Specter estimating losses above $86 million. The company said on October 9th, 2026 that it asked the reseller, named as CryptoBillis, to stop distributing its devices.
The scale of the reported losses has prompted questions about whether the incidents resulted from compromised hardware devices distributed through a supply chain or another security weakness. However, the available information does not establish a widespread vulnerability affecting Ledger’s entire product range.
Ledger acknowledged the reports in a statement published on its official support account on X early Friday. The company said it was examining incidents involving customers who purchased devices from a reseller identified in its statement as CryptoBilis.
The company announced a precautionary suspension of sales and shipments through the reseller while the investigation continues.
“Ledger is investigating reports of loss of funds from users in Southeast Asia who purchased products from a reseller named CryptoBillis,” the company wrote.
It added that it had asked the reseller to stop distributing the devices pending the outcome of its investigation.
The distinction is important because hardware wallets are designed to keep cryptocurrency private keys isolated from internet-connected devices, reducing exposure to many forms of online theft. However, the security of a hardware wallet also depends on the authenticity and integrity of the device, its setup process and the protection of its recovery phrase.
If a device has been counterfeit, modified before delivery or supplied with compromised recovery information, a customer could face risks that would not necessarily indicate a flaw in the manufacturer’s genuine products.
Ledger has not publicly established the precise technical mechanism behind the reported incidents in the information provided. Consequently, the Ledger wallet hack remains an investigation into reported losses rather than a confirmed finding of a general hardware-wallet vulnerability.
Blockchain investigator Specter published figures indicating that the reported losses were spread across several cryptocurrency networks. The figures highlighted substantial amounts of ETH, BTC and USDT allegedly removed from affected wallets.
According to the investigator’s data, the reported losses included more than $42 million in ETH, approximately $17.5 million in BTC and around $16.5 million worth of USDT. The overall estimate had surpassed $86 million by Friday morning.
These figures represent reported on-chain losses attributed to the incidents, rather than a final accounting independently confirmed by Ledger. The investigation may establish a more precise total as additional affected wallets are identified and transactions are examined.
Blockchain transactions can help investigators trace the movement of assets between addresses, although identifying the individuals responsible and recovering stolen funds can be more difficult. Cryptocurrency transfers may pass through multiple wallets, exchanges or other services, complicating efforts to establish ownership and follow the money.
The reported incidents also illustrate why users should distinguish between a hardware wallet’s security architecture and the integrity of the physical device they receive. A genuine hardware wallet can provide strong protection when used correctly, but counterfeit products or compromised recovery information may undermine those safeguards.
The Ledger wallet hack reports have therefore placed renewed attention on distribution channels, product authenticity and the procedures customers follow before transferring substantial holdings to a newly acquired device.
Alongside its investigation, Ledger issued guidance for customers who purchased devices from the reseller during the preceding 90 days. The company advised customers who had not yet configured their devices against starting the setup process until further information becomes available.
“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate setup if you have not done so yet,” the company said.
For customers who had already configured their devices, Ledger recommended considering a transfer of assets to a new Ledger signer using a new recovery phrase.
“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed),” the company added. It said it would continue providing updates as the investigation progressed.
The advice highlights the importance of using a genuinely new recovery phrase when moving funds away from a potentially compromised setup. Simply transferring assets to another address controlled by the same potentially exposed recovery phrase may not adequately address the underlying risk.
Customers should also be cautious about recovery requests, unsolicited technical-support messages and websites claiming to offer emergency assistance. A legitimate hardware-wallet provider should not require customers to disclose their private recovery phrases to resolve a security incident.
Anyone concerned about a potentially compromised device should consult official manufacturer guidance and independently verify the authenticity of support channels before taking action. The Ledger wallet hack investigation has not established that every device purchased from the reseller is compromised, but Ledger’s precautionary guidance indicates that affected customers should take the reports seriously.
The reports generated concern across social media, particularly among users who said they had stored their recovery phrases securely and had not knowingly authorised transactions that would explain the missing funds.
One purported customer described losing nearly $100,000 in USDT in a post on Reddit. The user said the recovery phrase had been handwritten and stored in a safe, while the Ledger Stax device had not been used for transactions beyond receiving funds.
“My Ledger wallet just got drained out of almost 100k USDT,” the user wrote.
The account illustrates the concerns raised by affected customers, although an individual social media post does not independently establish how the funds were accessed or whether the device was compromised before it reached the buyer.
Binance co-founder and former chief executive Changpeng Zhao also commented on the reports, suggesting that the incidents could be associated with a limited supply-chain problem rather than a weakness affecting all Ledger devices.
“Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers,” Zhao wrote on X.
He also defended the manufacturer’s broader security record, writing: “Ledger is one of the most secure and oldest hardware wallets in the industry. Stood the test of time. But these things happen.”
Zhao’s comments reflect an initial assessment rather than a definitive technical conclusion. The investigation will need to determine whether the affected devices were counterfeit, altered before distribution or compromised through another method.
For now, the Ledger wallet hack reports underscore the risks associated with acquiring cryptocurrency security products through unverified distribution channels. They also demonstrate that secure storage requires more than keeping a recovery phrase offline: customers must ensure that their devices are authentic and follow safe setup procedures.
Ledger’s findings will be important in determining the scope of the incidents, the mechanism behind the reported losses and whether additional customers need to take protective action. Until more evidence becomes available, users should follow official security updates, verify their devices’ provenance and avoid treating the reported losses as proof of a universal flaw in Ledger hardware wallets.
Copyright © 2025 - The Bit Gazette.
