Ledger Investigates Wallet Drains Linked to Southeast Asian Reseller CryptoBilis as Losses Estimated Up to $92.9M
Ledger is investigating reports of cryptocurrency wallet drains affecting users who bought devices from Southeast Asian reseller CryptoBilis, with onchain analysts estimating losses between $72M and $92.9M across multiple blockchains.
Read this event in français
Why it matters
The incident raises concerns about supply-chain security for hardware wallets sold through authorized resellers. If confirmed as a supply-chain compromise, it would represent a significant breach of trust in the hardware wallet distribution model. The scale of potential losses, approaching $93 million, adds to mounting crypto security losses in 2026.
Where the sources disagree
Total estimated losses
$86 million
Unchained
$72 million
Cointelegraph
Sources report significantly different loss estimates ranging from $72 million to $92.9 million
Number of affected addresses or wallets
8 addresses (tanuki42)
Unchained, Cointelegraph
10 addresses (Specter)
Unchained
98 addresses (Arkham Intelligence)
Crypto News Flash
311 wallets (Bitquery)
U.Today
hundreds of addresses/wallets
Unchained, Bitcoin.com News, CoinDesk, Protos, Finbold
Sources cite different counts of addresses or wallets involved in the suspected thefts
Reseller name spelling
CryptoBilis
Crypto News Flash, Decrypt, Protos, Cointelegraph, CryptoSlate, U.Today, Finbold
CryptoBillis
CoinGape, Finance Magnates Crypto, U.Today
Sources alternate between CryptoBilis and CryptoBillis spellings
Blockchains affected
Bitcoin, Ethereum, TRON
Unchained, CoinDesk, Decrypt, Protos, Cointelegraph
Bitcoin, Ethereum, TRON, BNB Chain, Polygon
U.Today, Finbold
Sources differ on which blockchains were involved in the drains
Figures that do not reconcile
Found by comparing the numbers in the reports automatically. They are differences, not yet confirmed to be about the same thing.
amount taken
$86 million
Unchained
$80 million
Protos
Unchained reports $86 million, Protos reports $80 million (7% apart).
amount taken
$86 million
Unchained
$93 Million
U.Today
Unchained reports $86 million, U.Today reports $93 Million (8% apart).
amount taken
$86 million
Bitcoin.com News
$93 Million
U.Today
Bitcoin.com News reports $86 million, U.Today reports $93 Million (8% apart).
amount taken
$86 million
Crypto News Flash
$93 Million
U.Today
Crypto News Flash reports $86 million, U.Today reports $93 Million (8% apart).
amount taken
$86 million
CoinDesk
$80 million
Protos
CoinDesk reports $86 million, Protos reports $80 million (7% apart).
amount taken (addresses)
$86 million
CoinDesk
$72 million
Cointelegraph
CoinDesk reports $86 million, Cointelegraph reports $72 million (16% apart).
amount taken
$86 million
CoinDesk
$93 Million
U.Today
CoinDesk reports $86 million, U.Today reports $93 Million (8% apart).
amount taken
$86 million
Finance Magnates Crypto
$80 million
Protos
Finance Magnates Crypto reports $86 million, Protos reports $80 million (7% apart).
amount taken (losses wallet)
$86 million
Finance Magnates Crypto
$72 million
Cointelegraph
Finance Magnates Crypto reports $86 million, Cointelegraph reports $72 million (16% apart).
amount taken
$86 million
Finance Magnates Crypto
$93 Million
U.Today
Finance Magnates Crypto reports $86 million, U.Today reports $93 Million (8% apart).
amount taken
$80 million
Protos
$90 million
CryptoSlate
Protos reports $80 million, CryptoSlate reports $90 million (11% apart).
amount taken
$80 million
Protos
$93 Million
U.Today
Protos reports $80 million, U.Today reports $93 Million (14% apart).
amount taken (losses)
$72 million
Cointelegraph
$90 million
CryptoSlate
Cointelegraph reports $72 million, CryptoSlate reports $90 million (20% apart).
amount taken
$72 million
Cointelegraph
$93 Million
U.Today
Cointelegraph reports $72 million, U.Today reports $93 Million (23% apart).
amount taken
$86 million
Bitcoin.com News
$80 million
Protos
Bitcoin.com News reports $86 million, Protos reports $80 million (7% apart).
amount taken (investigator losses)
$86 million
Bitcoin.com News
$72 million
Cointelegraph
Bitcoin.com News reports $86 million, Cointelegraph reports $72 million (16% apart).
amount taken (wallets)
$86 million
Crypto News Flash
$80 million
Protos
Crypto News Flash reports $86 million, Protos reports $80 million (7% apart).
amount taken (losses)
$86 million
Crypto News Flash
$72 million
Cointelegraph
Crypto News Flash reports $86 million, Cointelegraph reports $72 million (16% apart).
amount taken
$80 million
Protos
$72 million
Cointelegraph
Protos reports $80 million, Cointelegraph reports $72 million (10% apart).
Key facts
Ledger is investigating reports of cryptocurrency losses from users in Southeast Asia who purchased devices from reseller CryptoBilis
Reported by Bitcoin.com News
Ledger asked CryptoBilis to pause all sales and shipments of Ledger devices
Reported by Bitcoin.com News
Ledger advised customers who purchased from CryptoBilis in the past 90 days not to set up their devices
Reported by Bitcoin.com News
Ledger advised customers who already set up devices to move assets to a new Ledger signer with a fresh seed phrase
Reported by Bitcoin.com News
Onchain investigator Specter traced suspected theft addresses and reported losses over $86 million across Bitcoin, Ethereum, and TRON
86,000,000 USDDisputed figureReported by Unchained
Onchain investigator tanuki42 identified eight wallet addresses linked to over $72 million in losses
72,000,000 USDDisputed figureReported by Unchained
Arkham Intelligence identified 98 addresses holding approximately $86.96 million in cryptocurrency
86,960,000 USDDisputed figureReported by Crypto News Flash
Bitquery analysis expanded the reported total to $92.9 million across 311 wallets on five networks: Bitcoin, Ethereum, TRON, BNB Chain, and Polygon
92,900,000 USDDisputed figureReported by U.Today
What happened
Ledger confirmed on October 9 it is investigating reports of fund losses from users in Southeast Asia who purchased hardware wallets through reseller CryptoBilis, which operates in Indonesia, Malaysia, and the Philippines. The company asked CryptoBilis to pause sales and shipments and advised customers who bought devices in the past 90 days not to initialize them, while those who already set up wallets should consider moving assets to a new device with a fresh seed phrase. Onchain investigators Specter and tanuki42 traced suspected theft addresses across Bitcoin, Ethereum, and TRON, with Specter reporting over $86 million in losses and tanuki42 citing over $72 million. Arkham Intelligence identified 98 addresses holding approximately $86.96 million, while Bitquery later expanded the estimate to $92.9 million across 311 wallets on five networks including BNB Chain and Polygon. Tether has frozen USDT linked to the incident. Ledger stated its infrastructure, systems, and services were not compromised, though a supply-chain attack involving tampered devices remains a possible explanation. The cause, number of affected users, and total losses remain unconfirmed.
How the story developed
- Update
Tether freezes USDT linked to suspected thefts
Tether moved to freeze stablecoin connected to the incident
- Update
tanuki42 posts list of eight theft addresses with >$72M losses
Onchain investigator tanuki42 published address list at 12:00 UTC asking victims to contact SEAL 911
- Update
Security Alliance (SEAL) amplifies tanuki42 alert
SEAL quote-posted tanuki42 list at 12:29 UTC directing victims to SEAL 911 Telegram bot
- First report
First report by Unchained
Ledger Users Reportedly Drained of Over $86 Million Across Several Blockchains
- Official statement
Official statement from Bitcoin.com News
Ledger Investigating Reports of Drained Crypto Wallets as Estimated Losses Hit $86M
- Official statement
Ledger posts official statement acknowledging reports and naming CryptoBilis
Ledger Support posted on X confirming investigation and asking reseller to pause sales
- Mainstream pickup
Picked up by mainstream media (Finance Magnates Crypto)
Ledger Probes Reseller Supply Chain as Analysts Track $86 Million in Suspected Drains
- Update
Bitquery analysis expands loss estimate to $92.9M across 311 wallets on five networks
Subsequent analysis by Bitquery increased the reported total and scope of affected chains
How coverage built up
Independent sources over time, counted the way the consensus panel counts them: a republication of a wire story does not move the line.
- 9 Oct 2026, 13:41 UTC: Unchained — 1 independent source, 1 reports
- 9 Oct 2026, 14:35 UTC: Bitcoin.com News, official — 2 independent sources, 2 reports
- 9 Oct 2026, 14:47 UTC: CoinDesk — 3 independent sources, 4 reports
- 9 Oct 2026, 14:53 UTC: U.Today — 4 independent sources, 5 reports
- 9 Oct 2026, 14:54 UTC: CoinGape — 5 independent sources, 6 reports
- 9 Oct 2026, 15:30 UTC: Decrypt — 6 independent sources, 7 reports
- 9 Oct 2026, 16:39 UTC: Finance Magnates Crypto, Mainstream media — 7 independent sources, 8 reports
- 9 Oct 2026, 16:40 UTC: Protos — 8 independent sources, 9 reports
- 9 Oct 2026, 17:02 UTC: Cointelegraph — 9 independent sources, 10 reports
- 9 Oct 2026, 17:30 UTC: Crypto News (CryptoNews.net) — 10 independent sources, 11 reports
- 9 Oct 2026, 21:10 UTC: CryptoSlate — 11 independent sources, 12 reports
- 10 Oct 2026, 05:37 UTC: CryptoPotato — 12 independent sources, 13 reports
- 10 Oct 2026, 16:22 UTC: Finbold — 13 independent sources, 15 reports
- 12 Oct 2026, 17:19 UTC: Bitcoin Magazine — 14 independent sources, 17 reports
Affected entities
Also mentioned: Binance, BNB, Polygon, USD Coin, Chainlink, Liquid Network, Solana
Original sources
Related events
CZ urges a waiting period for new hardware wallets after Southeast Asia Ledger reseller thefts
Changpeng Zhao advised users to keep new hardware wallets unused for weeks after losses linked to a compromised Ledger reseller in Southeast Asia; Ledger says its own systems were not compromised.
Tom Lee says the fund he controls holds $16 billion in Ethereum, near 5% of supply
U.Today reported that Fundstrat cofounder and BitMine chairman Tom Lee says the fund he controls holds $16 billion in Ethereum, nearly 5% of total supply.
BNB Chain passes Solana in DeFi TVL on September 14 data, CZ calls Ethereum flip a long road
U.Today reports BNB Chain held $5.94 billion in DeFi TVL on September 14, above Solana at $5.89 billion, and that Binance founder Changpeng Zhao called overtaking Ethereum a long road.
CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk
Binance Founder CZ Warns AI Phishing Threatens Crypto Users Without Breaking Bitcoin Cryptography
Changpeng Zhao says leaked personal data enables AI-powered phishing attacks against crypto users, not breakthroughs against blockchain encryption.
Zhao denies his August tweet drove a 20% Bitcoin rally, calls a $3 trillion crypto market unsaturated
Binance founder Changpeng Zhao denied his August 19 tweet triggered a 20% Bitcoin rally and said crypto adoption stays under 1% globally.