Ledger has launched an investigation into reported fund losses among Southeast Asian users who bought devices from reseller CryptoBilis.
France-based hardware wallet provider Ledger has asked CryptoBilis to suspend all sales and shipments of its devices while it reviews reports that customers in Southeast Asia lost funds after buying hardware from the reseller. The company announced the move through its support account on X, describing it as a precautionary step pending the outcome of its investigation.
Ledger has advised anyone who purchased a device from CryptoBilis within the past 90 days not to set it up if they have not yet done so. Customers who have already initialised their devices are encouraged to consider moving their assets to a new Ledger signer generated with a fresh seed phrase, the master backup from which a wallet’s private keys can be regenerated.
Cause and scale remain unconfirmed
Ledger has not disclosed what caused the losses or how many customers have been affected. Hardware wallets are designed to keep private keys offline, but that protection depends on the device being intact before it reaches the buyer. A unit compromised before delivery, such as one shipped with a recovery phrase already known to an attacker, can leave funds exposed regardless of how the owner later uses it. No tampering has been confirmed so far.
Early estimates suggest the losses could run into the tens of millions. Pseudonymous on-chain investigator Specter reported tracing theft addresses flagged by Ledger users on X and Reddit, identifying inflows from hundreds of victim wallets across the Ethereum, Tron, and Bitcoin networks. Specter put total losses at more than USD 86 million. Arkham data shared by the investigator shows close to USD 87 million held at those addresses, including approximately USD 42 million in ETH, USD 17.6 million in BTC, and USD 16.5 million in USDT. Ledger has not confirmed the figure, and it remains unclear whether every theft is connected to the reseller.
Security pressure across the crypto sector
The case places the distribution chain for self-custody devices under scrutiny. Ledger’s competitor Trezor has faced its own security issues, including customer data exposed through a breach at a shipping partner and a breach of its email in September 2026.
The incident also follows a series of high-value security events in the crypto market. In September 2026, Bitget lost around USD 387 million in a hack that investigators have attributed to North Korea, with blockchain analytics firms Chainalysis and Elliptic tracing part of the stolen funds. North Korean hackers also spent six months infiltrating Solana-based exchange Drift before a USD 285 million exploit, after which Drift outlined a plan to repay affected users. Separately, in September 2026, self-described white hat hackers withdrew USD 320 million in Bitcoin from Blockstream’s Liquid sidechain before entering negotiations with the company.
Ledger’s findings are expected to clarify whether the reported thefts originate from devices sold through CryptoBilis and to what extent customers of the reseller have been affected.
