ledger-wallet-hack
Ledger is investigating reported cryptocurrency losses in Southeast Asia after confirming that one device belonging to an affected user contained an unauthorized hardware implant. Pseudonymous blockchain investigator Specter estimated that losses exceeded $86 million across Bitcoin, Ethereum, and Tron, while Ledger described the confirmed cases as limited and said the incident appeared isolated to one reseller and its Southeast Asian market.
Key Points
- Ledger confirmed an unauthorized implant in one device sold through the CryptoBilis reseller.
- Reported losses were estimated at more than $86 million, but Ledger has not confirmed the total or the number of affected customers.
- Ledger said its infrastructure, systems, and services were not compromised.
- CryptoBilis stopped selling its hardware-wallet inventory while the investigation continues.
- Customers who have not set up affected devices should not do so, while users who already set them up should consider moving assets to a new signer with a new seed phrase.
What Ledger found
Ledger, a Paris-based technology company focused on digital-asset security and cryptocurrency hardware wallets, said it was investigating reports of lost funds from Southeast Asian customers who bought Ledger devices through CryptoBilis. Ledger asked the reseller to pause sales and shipments while the investigation was underway.
In an update posted on October 11, 2026, Ledger described the incident as affecting a “limited” number of devices and said all confirmed cases involved devices sold through CryptoBilis. Ledger also confirmed that one device belonging to an affected user contained an unauthorized hardware implant and said it was contacting users as part of the investigation.
Ledger said the incident appeared isolated to CryptoBilis and its Southeast Asian market. It said its infrastructure, systems, and services were not compromised, and it had not confirmed how many customers were affected or the value of the reported losses.
Blockchain data points to large losses
Specter said they traced theft addresses flagged in Ledger-user reports on X and Reddit and found inflows from hundreds of victim wallets across Ethereum, Tron, and Bitcoin. Specter estimated that total losses exceeded $86 million.
“Total losses $86M+.”
Specter, blockchain investigator
Data from Arkham Intelligence, a blockchain analytics and intelligence platform, that was shared by Specter showed nearly $87 million at the identified addresses. The data included approximately $42 million in ETH, $17.6 million in BTC, and $16.5 million in USDT.
Ledger has not confirmed the blockchain estimate. It also remains unclear whether every theft tracked in the reported addresses was connected to the CryptoBilis reseller.
Timeline and customer advice
On Friday, Ledger said it was investigating the reports and advised people who had bought a device from CryptoBilis during the previous 90 days not to initiate setup if they had not already done so. Customers who had already set up a device were advised to consider moving their assets to a new Ledger signer with a new seed phrase.
Ledger confirmed the hardware implant in a Saturday post on X. After the implant was identified, CryptoBilis stopped sales of its hardware-wallet inventory until the investigation was concluded, and Ledger said it was in active communication with the reseller about next steps.
Ledger advised resellers and distributors to source products only through authorized channels and not to restock returned products. CryptoBilis said a recovery phrase should be generated by the device during setup and written down by the user. Its alert said users should treat a wallet as unsafe if the recovery phrase was already printed or written on a card or sheet, or if anyone else had seen it.
CryptoBilis also warned users not to share their recovery phrase or PIN and cautioned against people offering to recover lost funds. Ledger directed users who need assistance to its official support channel at support.ledger.com and asked people with relevant information to contact its bounty program at bounty@ledger.fr.
The incident reports reviewed did not identify a CVE associated with the activity. Ledger’s investigation remained ongoing, with confirmed cases limited to devices sold through CryptoBilis and the reseller’s hardware-wallet sales paused pending the outcome.
Sources
About the Author
