Key Takeaways
All confirmed cases still trace to one reseller. In its 72-hour update on October 12, 2026, Ledger said every confirmed case tied to the October 9 draining incident involves devices sold through CryptoBilis, and that its own systems and direct sales were not affected.
CryptoBilis has stopped selling hardware wallets. Ledger said the reseller confirmed it has ceased all hardware wallet sales, and Ledger told its other resellers never to restock returned products.
The advice for buyers has not changed. Do not set up an unused CryptoBilis device. If you already did, move your funds to a new seed on a device bought from Ledger, and use only official support channels.
What Happened: A Short Recap
On October 9, 2026, Ledger said it was investigating reports that users in Southeast Asia had lost funds after buying devices from CryptoBilis, a reseller listed on Ledger's official reseller page for Indonesia, Malaysia, and the Philippines. Ledger asked the shop to pause all sales and shipments.
On October 10, Ledger confirmed that at least one affected user's device contained an unauthorized hardware implant. Researchers, including former Mt. Gox head Mark Karpeles and hardware hacker Joe Grand, had described similar implants that read the seed phrase from the screen and send it out over a hidden mobile modem.
On October 12, roughly 72 hours after the first notice, Ledger published a progress update. This article explains what that update says, what it does not say, and what buyers should do now.
For a deeper explanation of how this kind of attack works, see our guide to hardware wallet supply chain attacks.
What Ledger Said in the 72-Hour Update
The table below summarizes the main points of Ledger's statement in plain terms.
Topic | What Ledger said |
|---|---|
Scope | "The volume of impacted devices is limited." No number was given. |
Source of cases | All confirmed cases related to the October 9 incident involve devices sold through CryptoBilis |
Ledger's own systems | Its systems and direct sales channels remain unaffected |
CryptoBilis status | CryptoBilis has confirmed it has ceased all sales of hardware wallets |
Other resellers | Told to source products only through authorized channels and never to restock returned products |
Unauthorized sellers | Users strongly advised not to buy from them |
Investigation | Ongoing, with relevant authorities and the security group SEAL 911 |
Industry call | Asked other vendors and researchers to work on chain-of-custody and anti-tamper improvements |
Contact | Affected users should use Ledger Support at support.ledger.com; researchers can email security@ledger.com |
Why the "Returned Products" Line Matters
One detail stands out. Ledger told its authorized resellers and distributors never to restock returned products.
Ledger did not say returns played a role in this case. But the instruction points to a known weak spot. A returned device has already left the controlled supply chain. Anyone who held it could have opened it, added hardware, and sent it back. If a shop then sells it again as new, the next buyer has no way to know.
This is the same reason security guides warn against buying secondhand or "open box" hardware wallets.
What Is Confirmed vs What Is Estimated
News coverage of this incident mixes official statements with on-chain estimates and social media reports. It helps to keep them apart.
Claim | Status | Source |
|---|---|---|
Losses among CryptoBilis buyers | Confirmed as under investigation | Ledger |
At least one device had a hardware implant | Confirmed for one device | Ledger, October 10 |
All confirmed cases involve CryptoBilis | Ledger's position as of October 12 | Ledger |
CryptoBilis has ceased hardware wallet sales | Stated by Ledger as confirmed by CryptoBilis | Ledger |
Number of affected devices | Described only as "limited" | Ledger |
Losses of about $72 million to more than $86 million | Estimate, not confirmed by Ledger | On-chain researchers tanuki42 and Specter |
Some reports cite figures near $90 million | Estimate | Media reports |
A Nano X bought in Europe also held an implant | Unverified; not among Ledger's confirmed cases | A user report on X |
Every reported loss was caused by an implant | Not established | No source has shown this |
Important: Ledger has not published a loss figure, a device count, or a full explanation of how funds left every affected wallet. Some losses counted by on-chain researchers may have other causes. Treat the dollar totals as widely reported estimates.
What This Means for Different Buyers
Your next step depends on where your device came from.
Where you bought your device | Recommended action based on Ledger's guidance |
|---|---|
CryptoBilis, not yet set up | Do not initialize it. Contact Ledger Support through the official site |
CryptoBilis, already set up | Treat the seed as exposed. Move funds to a new seed on a device bought from Ledger |
Directly from Ledger | Ledger says direct sales are unaffected. Keep normal safety habits |
Another authorized reseller | No confirmed cases so far. Check the device and follow Ledger's notices |
Marketplace, secondhand, or unknown seller | Higher general risk. Ledger strongly advises against these channels |
Other Brands Sold by CryptoBilis
Reports note that CryptoBilis has also sold wallets from other makers, such as Trezor, Tangem, OneKey, and SafePal. As of October 12, no public report has confirmed tampering with those brands. Owners of any device bought from this shop may still want to contact the maker of their device for guidance.
Step by Step: If You Bought From CryptoBilis
These are general safety steps for education, based on Ledger's public guidance. They are not financial or legal advice.
Stop. If the device is still in its box, do not set it up or enter any seed into it.
Get a new device from a trusted source. Ledger's guidance is to buy from Ledger directly.
Create a brand new seed on the new device. Do not reuse your old 24 words. A seed shown on a suspect device, or typed into one, should be treated as known to an attacker.
Move your funds from the old wallet to addresses generated by the new seed. Check every receiving address on the new device's screen.
Keep records. Save the receipt, order details, photos of the device, and any transaction IDs.
Contact Ledger Support only through support.ledger.com.
File a report with your local police or cybercrime unit, as Ledger recommends.
Watch Out for Follow-Up Scams
Ledger's update ends with a warning that scammers often use incidents like this one. Fake support agents, fake "compensation" forms, and fake recovery services tend to appear soon after any major news.
Ledger states that it will never call you, send you a direct message, or ask for your 24-word recovery phrase.
Scam pattern | What it looks like | Safe response |
|---|---|---|
Fake support | A DM or call offering to help with the CryptoBilis issue | Ignore it. Go to support.ledger.com yourself |
Fake refund or claim form | A link asking you to "verify" your wallet for compensation | Never enter your seed phrase anywhere |
Fake firmware or app | A download link for a "security patch" | Use only the official Ledger app from official sources |
Recovery services | Someone promising to get stolen funds back for a fee | Legitimate recovery runs through police, courts, or official channels |
Why This Case Matters Beyond One Shop
Most buyers have been taught a simple rule: buy from the maker or an authorized reseller. This case shows that the rule still helps, but it is not a full guarantee. CryptoBilis was an official, listed partner, and the secure chip inside the confirmed device was not broken.
The weak point was the path the device took to reach the buyer. That is why Ledger's update focuses on reseller controls, returned stock, and shared anti-tamper standards rather than on firmware.
What Comes Next
Several questions remain open as of October 12:
How many devices were affected? Ledger says the number is limited but has not shared a count.
Where was tampering done? Ledger has not said at what point in the supply chain the implants were added.
What new controls will Ledger introduce? The company says it is reviewing authorized reseller controls and advancing hardware protections, without details yet.
Will industry-wide standards follow? Ledger has invited other vendors and researchers to work on shared chain-of-custody practices.
We will update this article as official information changes.
FAQ
What did Ledger say in its 72-hour update on CryptoBilis? Ledger said all confirmed cases involve devices sold through CryptoBilis, the number of affected devices is limited, its own systems are unaffected, and CryptoBilis has ceased all hardware wallet sales.
Is a Ledger bought directly from Ledger affected? According to Ledger, its direct sales channels remain unaffected and all confirmed cases so far involve CryptoBilis.
How much money was lost in the CryptoBilis incident? Ledger has not published a figure. On-chain researchers estimate roughly $72 million to more than $86 million, but these totals are unconfirmed and may include unrelated losses.
Can a firmware update protect a tampered device? No. A hardware implant is extra physical hardware inside the case. Firmware cannot detect or remove it, which is why Ledger advises moving to a new seed on a new device.
Will Ledger contact me about this incident? Ledger says it is reaching out to impacted users, but it will never call you, DM you, or ask for your recovery phrase. Start any contact yourself through support.ledger.com.
Related Terms
Authorized Reseller: A third-party shop that a manufacturer officially permits to sell its products, usually listed on the manufacturer's website.
Recovery Scam: A fraud that targets past victims by promising to retrieve lost funds in exchange for an upfront fee or private information.
Hardware Wallet: A physical device that stores the private keys to crypto offline and signs transactions without exposing them to the internet.
Supply Chain Attack: An attack that compromises a product somewhere between its maker and its user, such as at a distributor, reseller, or shipper.
Seed Phrase: A list of 12 to 24 words that can restore a crypto wallet and every key it controls.
Sources
Ledger, "72 hour update on reseller CryptoBilis incident," statement posted on X (October 12, 2026); Ledger Support: https://support.ledger.com
The Block, "Ledger investigates wallet drains involving CryptoBilis buyers; estimate tops $86 million in losses" (2026): https://theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163
Cointelegraph, "Ledger investigates fund losses linked to Southeast Asian reseller, warns users" (2026): https://cointelegraph.com/news/ledger-investigates-fund-losses-linked-to-southeast-asian-reseller-warns-users
Decrypt, Ledger investigating CryptoBilis reseller losses (2026): https://decrypt.co/380582
Bitcoin Magazine, "Ledger Warns Buyers Not to Set Up Wallets From Reseller After Users Report Losses" (2026): https://bitcoinmagazine.com/news/ledger-warns-users-after-losses-reported
Gizmodo, Ledger wallets reportedly backdoored, $71 million moved (2026): https://gizmodo.com/ledgers-crypto-wallets-reportedly-backdoored-71-million-in-crypto-already-moved-2000824372
Protos, "Ledger says Southeast Asia reseller linked to $86M draining" (2026): https://protos.com/ledger-says-southeast-asia-reseller-linked-to-86m-draining/
Bitcoin.com News, "Ledger Confirms Hidden Hardware Implant in Affected User's Wallet" (2026): https://news.bitcoin.com/security/ledger-confirms-hidden-hardware-implant-in-affected-users-wallet/
Finance Magnates, "Ledger Probes Reseller Supply Chain as Analysts Track $86 Million in Suspected Drains" (2026): https://www.financemagnates.com/cryptocurrency/ledger-probes-reseller-supply-chain-as-analysts-track-80m-in-suspected-drains/
Disclaimer: This article is for educational purposes only and does not constitute financial, legal or tax advice. Always verify details with official sources. All the information is based on the date of publication.
