Ledger CryptoBilis wallet drains: $86 million gone, what we know and how to check your wallet

What happened in the Ledger CryptoBilis wallet drains

CryptoBilis is an official Ledger reseller in Indonesia, Malaysia and the Philippines. On Friday, October 9, Ledger's support team posted on X that it was looking into reports of lost funds from Southeast Asian users who had bought devices from this seller. The company asked CryptoBilis to halt all sales and shipments of Ledger devices until the investigation is over.

The alarm was first raised by wallet owners themselves, who posted on X and Reddit that coins had vanished from their addresses. On-chain sleuths started piecing those addresses together. By tanuki42's count, more than $72 million flowed into a cluster of suspicious addresses. A little later Specter put the losses at over $86 million and traced the money across Bitcoin, Ethereum and TRON, with inflows "from hundreds of victim wallets."

Neither figure has been independently confirmed. Specter himself noted that the number of victims is unknown, Ledger hasn't given a total, and it's unclear whether the two researchers are counting the same transfers. What is clear is that this ranks among the largest thefts ever aimed at hardware wallet owners rather than at exchanges.

What Ledger recommends

The company's official guidance is short:

• if you bought a device from CryptoBilis in the last 90 days and haven't set it up yet, don't start the setup;
• if you've already set it up, consider moving your funds to a new Ledger device with a new seed phrase;
• the company says it will share updates as the investigation progresses.

Ledger stresses that it sees no sign of a breach of its own systems or wallet software. The investigation covers devices sold through a third-party seller, not every Ledger wallet out there. The company says it has sold more than 7 million devices.

How the coins could have been stolen

As of the evening of October 9 there is no official explanation. Three theories are doing the rounds.

A device tampered with on its way to the buyer

The most widely discussed theory is a supply chain attack, where a device is swapped or opened before it ever reaches the customer. The box can come with a "ready-made" seed phrase the attacker already knows, or the device itself can be a fake that generates keys known in advance. The owner tops up the wallet without suspecting a thing, while the thief waits for the balance to grow and then sweeps everything in one go.

Former Binance CEO Changpeng Zhao (CZ) wrote that, based on what is known so far, it looks like an attack through a single seller and that a small number of users may have bought fake or tampered devices. "Self-custody comes with extra responsibility," he added. Former Mt. Gox CEO Mark Karpeles asked victims to send him photos of their devices' circuit boards, saying the case may be linked to an issue he is already looking into.

Phishing and a leaked seed phrase

Some of the losses may turn out to be plain phishing: a fake app, a "wallet recovery" website, or a "support agent" on a messenger to whom the victim read out all 24 words. After big headlines like this one, those "helpers" only multiply.

A malicious transaction signed by the owner

Another possibility is that users approved a transaction on their own device that gave a stranger access to their tokens. A hardware wallet faithfully signs whatever it is shown, and it can't save you if you don't read the screen.

None of these theories has been confirmed, and researchers are urging people not to jump to conclusions about a "hole" in every Ledger wallet.

Why a hardware wallet doesn't protect you on its own

A hardware wallet keeps your private key on a separate chip and never hands it to your computer. But all of that protection rests on one condition: the seed phrase was generated by your device during first setup, and nobody but you has ever seen it. If someone else created the phrase in advance, at a back-alley "factory" or in a seller's warehouse, your expensive wallet becomes someone else's safe, and the thief holds the key.

You can buy coins anywhere: on an exchange, from a friend, or through a no-registration crypto exchange straight to your own address. But you can only store them safely where the key is definitely yours. We've covered how to store a seed phrase so it doesn't get stolen or lost in a separate guide.

The golden rule is simple: a genuine wallet never arrives with a pre-filled seed phrase. Manufacturers put blank recovery cards in the box, and the words appear on the device's screen only during setup.

How to check your hardware wallet

Go through this checklist, even if you didn't buy from CryptoBilis:

1. Where you bought it. The manufacturer's website is the safest option. Marketplaces, resellers of unknown origin, "30% off" deals and second-hand devices are out straight away. The CryptoBilis case shows that even an official seller can have problems, so the rest of this list always matters.
2. Seed phrase. It must appear on the device's own screen during first setup. A card with printed words, a PIN that's already set, or a device "set up for you" is a reason not to put a single cent on it.
3. Authenticity check. When you connect the device, the Ledger Live app checks whether it's genuine. Install the app only from the official website, never from an ad or a link in a chat.
4. Device screen. Check the address and amount on the wallet's screen, not just in the app. That protects you from malware on your computer.
5. Support. No real support team will ever ask for your seed phrase. Anyone who does is a scammer, even if they write from an "official" account.

If even one item raises doubts, the safest move is a new seed phrase on a device bought from the manufacturer, followed by moving your coins.

What to do if you bought from CryptoBilis or aren't sure

The device isn't set up yet. Don't turn it on, and contact Ledger support through the official website. Don't send any coins to it.

The device is already in use. Move your coins now rather than waiting for the investigation to wrap up. Here's the order:

1. A new device bought from the manufacturer, with a new seed phrase generated on it.
2. A small test transfer to the new address.
3. Moving the rest across every network where you hold coins: bitcoin, ether and tokens, USDT on TRON. For USDT TRC20, keep a little TRX for fees, or the transfer will get stuck: this morning we explained how much a USDT transfer on TRON costs and what energy has to do with it.

While moving funds, watch out for address poisoning scams: scammers monitor large transfers and plant look-alike addresses in your wallet history. Copy the new address only from the new device's screen.

The coins are already gone. Save the transaction hash, file a police report and contact Ledger support. If USDT or USDC was stolen, speed matters: the issuer can freeze the coins at law enforcement's request before the thief swaps them. And never pay "recovery services" that reach out to you first: after big thefts they are the second wave of the scam.

How to move coins to a new wallet and swap them without registration

Switching to a new seed phrase is a good moment to rebalance your portfolio. You have to send your coins to a new address anyway, and you can swap them along the way. For example, you could turn part of your USDT, which the issuer can freeze, into bitcoin, which nobody can freeze.

With VertEXchange you can do this without an account, email or phone number. You pick a pair, paste the new wallet address copied from the device screen, and see the rate and the exact amount you'll receive before you send anything.

• A fixed rate holds for about 15 minutes, which is plenty of time to calmly check the address on your wallet's screen.
• VertEXchange doesn't hold your coins; they go straight to your new address.
• If the exchange doesn't go through, your coins are returned to your refund address.
• Personal fields of an operation are deleted 24 hours after it completes, and your exchange history stays only in your browser.
• If anything is unclear, support chat is available on every page, and issues are resolved using your exchange code.

The most common moves during a wallet migration are to swap USDT TRC20 to bitcoin straight to a new wallet or to exchange ETH to BTC without registration so the core of the portfolio sits in one coin.

FAQ

What happened to Ledger wallets in October 2026?

Users in Southeast Asia who bought Ledger wallets from the reseller CryptoBilis reported stolen coins. On-chain analysts estimate losses at $72-86 million across Bitcoin, Ethereum and TRON. Ledger is investigating and has halted sales through this seller.

Was Ledger hacked?

According to the company, there are no signs of a breach of its systems or wallet software. The investigation concerns devices sold through a single third-party reseller. The cause of the thefts hasn't been named yet.

I bought a Ledger from CryptoBilis. What should I do?

If the device isn't set up yet, don't set it up and contact Ledger support. If you're already using it, move your coins to a new device with a new seed phrase, bought directly from the manufacturer.

How can I tell if my hardware wallet has been tampered with?

The main red flag is a seed phrase you didn't create yourself: a printed card in the box, a PIN that's already set, or a device that's already configured. A genuine wallet shows the words on its own screen during first setup.

Are hardware wallets still safe after the Ledger CryptoBilis incident?

Yes, as long as it was bought from the manufacturer and you generated the seed phrase yourself. A hardware wallet protects your key from your computer and malware, but not from a phrase someone knew in advance.

Can stolen crypto be recovered?

There's a chance only with stablecoins: the issuer can freeze USDT or USDC at a police request if they haven't been swapped yet. Bitcoin and ether are almost impossible to get back, which is why moving your coins early matters so much.