# Ledger buyers in Southeast Asia lose about $86 million after buying devices from reseller CryptoBilis

Ledger has stopped the reseller's sales and says its own systems were not breached. Tether froze linked USDT within hours, but nobody has yet shown how the devices were compromised.

- Published: 2026-10-10T05:48:41.996Z
- Canonical: https://polylog.news/crypto/2026-10-10/ledger-buyers-in-southeast-asia-lose-about-86-million-after
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CoinDesk](https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen), [CryptoSlate](https://cryptoslate.com/ledger-hack-scare-nears-90-million-as-tether-moves-to-freeze-stolen-usdt/), [Bitcoin Magazine](https://bitcoinmagazine.com/news/ledger-warns-users-after-losses-reported), [Polylog editors](https://polylog.news), [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5596402.0), [Decrypt](https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller), [The Block](https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163), [BitPinas](https://bitpinas.com/business/ledger-cryptobilis/)

Ledger, the French hardware wallet maker, is investigating reports that customers who bought its devices from CryptoBilis had their wallets emptied. CryptoBilis is an authorized reseller serving Indonesia, Malaysia and the Philippines. The on-chain investigator Specter traced [more than $86 million in suspected thefts](https://www.coindesk.com/business/2026/10/09/ledger-investigates-potential-wallet-tampering-after-reports-of-usd86-million-in-crypto-stolen) across Bitcoin, Ethereum and Tron addresses. [Decrypt reports](https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller) that the losses include roughly $17.6 million in bitcoin, about $42 million on Ethereum and $16.5 million in Tron-based USDT. [CryptoSlate puts the running total](https://cryptoslate.com/ledger-hack-scare-nears-90-million-as-tether-moves-to-freeze-stolen-usdt/) close to $90 million.

Individual losses are large. The on-chain analytics account Lookonchain reported that one holder [lost all 80 bitcoin](https://t.me/cointelegraph/72581), bought for $5.2 million, after moving them to a Ledger purchased from the reseller.

Ledger asked CryptoBilis to [pause all sales and shipments](https://bitcoinmagazine.com/news/ledger-warns-users-after-losses-reported). It told anyone who bought from the reseller in the past 90 days not to set up the device. Buyers who have already set one up should move their assets to a new signer with a freshly generated seed phrase, [according to BitPinas](https://bitpinas.com/business/ledger-cryptobilis/). Ledger said it has no loss reports for devices bought directly from the company and that [its own infrastructure was not compromised](https://www.theblock.co/news/business/2026-10-09-ledger-cryptobilis-fund-losses-418163). Ledger has not confirmed the loss figure or the cause. The reports this desk reviewed do not include CryptoBilis's account of what happened.

How the attack worked is still unproven. All of the evidence found so far points to the distribution channel. There is no sign of a break in the device's cryptography itself. There are three leading explanations. The first is that devices were set up before sale with a seed phrase the attacker recorded and then resealed in their packaging. The second is a hardware or firmware implant. The third is phishing that followed a leak of customer data. The French-language channel Goku Crypto News noted that on Sept. 2 the hardware researcher Joe Grand [took apart a modified Ledger Nano X](https://t.me/GokuCryptoNews/20917) and found an implant with an antenna, memory and an embedded SIM (eSIM). That implant was designed to monitor the wallet rather than to break its security. Developers on [Bitcointalk's technical board](https://bitcointalk.org/index.php?topic=5596402.0) are debating which explanation fits the drain pattern.

Only part of the money can be recovered. Tether began [freezing USDT at addresses linked to the drains](https://cryptoslate.com/ledger-hack-scare-nears-90-million-as-tether-moves-to-freeze-stolen-usdt/), according to the blockchain security firm MistTrack. Bitcoin and ether have no issuer that can freeze them. Those parts of the loss can be recovered only if the thief sends them through an exchange that cooperates with investigators. No one has publicly identified the attacker. [Goku Crypto News reported](https://t.me/GokuCryptoNews/20915) that Ledger is reviewing several separate loss reports.

## What this means

Self-custody assumes that the device generates a secret only the buyer ever sees. If a reseller can learn that secret, it defeats the whole model without breaking any cryptography. The people most exposed are holders who bought through third-party channels across Asia. Ledger's reseller network is exposed through lost sales and possible liability. Rival device makers that rely on distributors face the same risk. Ledger benefits if the cause turns out to be confined to the reseller, so its early statement deserves scrutiny until forensics are published. The closest precedent is Ledger's 2020 customer-database leak, which led to years of phishing and physical threats against named holders. The desk's read is that Ledger will most likely confirm a reseller-level compromise within weeks. It would then tighten its authorized-reseller rules and push device-authenticity checks harder. Direct sales would see limited lasting damage, but cautious holders in emerging markets would move a little further toward custodial and exchange-traded products. That read is wrong if a teardown finds tampering that passes Ledger's own genuineness check. That would put every third-party channel in question, not one Malaysian distributor.

## What to watch

- Ledger's forensic findings on returned CryptoBilis devices. A pre-generated seed phrase, an implant and a data-leak phishing campaign each point to a different fix and a different party carrying the liability.
- Whether buyers outside the CryptoBilis channel report the same kind of drains. That would mean the problem is wider than one reseller.
- Movement of the stolen bitcoin and ether toward exchanges or mixers. Unlike USDT, those funds can be recovered only at a cooperating off-ramp.