# Ledger Halts Southeast Asian Reseller After Up to $93 Million Is Drained From Customers' Wallets

Investigators say the leading explanation is a hidden component inside sealed devices that reads the recovery words, which would move the risk from Ledger's code to the route a device takes to its buyer.

- Published: 2026-10-11T05:46:49.306Z
- Canonical: https://polylog.news/crypto/2026-10-11/ledger-halts-southeast-asian-reseller-after-up-to-93-million
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5596402.0), [Polylog editors](https://polylog.news), [Bitcoin Magazine](https://bitcoinmagazine.com/news/meanwhile-bitcoin-raises-37-million), [Decrypt](https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller), [Bitquery](https://www.bitquery.io/investigations/ledger-cryptobilis-hack), [Crypto Briefing](https://cryptobriefing.com/ledger-malaysia-hidden-implant-cryptobilis/)

Ledger, the French hardware-wallet maker, has asked CryptoBilis, its reseller in Malaysia, Indonesia and the Philippines, to [pause all sales and shipments of Ledger devices](https://x.com/Ledger_Support/status/2108551100613714002). The request came after owners of devices bought through that channel found on October 9 that their funds were gone. Users first raised the problem on the [Bitcointalk technical forum](https://bitcointalk.org/index.php?topic=5596402.0), and the loss estimates have risen since then. The on-chain analyst Specter traced ten collection addresses and put losses [above $86 million](https://decrypt.co/380582/ledger-probes-87m-theft-crypto-wallet-reseller). Bitquery counts [$92.9 million taken from 311 wallets](https://www.bitquery.io/investigations/ledger-cryptobilis-hack) on Tron, Bitcoin, Ethereum, BNB Chain and Polygon.

The method is not confirmed. The explanation that investigators currently favor is physical tampering. Mark Karpelès, the former chief executive of the Mt. Gox exchange, said he bought a Ledger device in Malaysia with its shrink wrap intact and found [a concealed electronic implant](https://cryptobriefing.com/ledger-malaysia-hidden-implant-cryptobilis/) behind the screen padding. The implant is reported to capture the recovery words that control a wallet (the seed phrase). His account has not been independently verified. Ledger says it has no indication that its own security infrastructure or services were compromised. It has also not accused CryptoBilis of altering devices. Nothing public yet shows whether the tampering happened at the shop, inside its warehouse, or earlier in the supply of counterfeit goods.

Ledger has told anyone who bought from the reseller in the last 90 days not to set up an unopened device. Buyers who already set one up should move their assets to a new device with a newly generated recovery phrase. If the implant account holds, Ledger's built-in check that a device is genuine would not have caught it. That check confirms the secure chip, and an added part that copies the words shown on the screen would not alter the chip.

The theft comes as large holders reconsider how they hold their keys. Changpeng Zhao, the founder of Binance, published [a short guide to self-custody and estate planning](https://t.me/GokuCryptoNews/20934) on October 10. It opens with the line "Nothing is completely secure" and tells holders to match their protection to the value they hold. On the same day, Meanwhile, a Bermuda-regulated bitcoin life insurer backed by Bain Capital Crypto and Sam Altman, [raised $37.5 million](https://bitcoinmagazine.com/news/meanwhile-bitcoin-raises-37-million) to serve wealthy families who want to pass on their bitcoin. The company has now raised more than $180 million.

Ledger and its competitors have different interests in how this story is told. If the cause is tampering in the supply chain, Ledger's firmware and secure element remain uncompromised, and the failure belongs to the sales channel. Rival device makers and custodial providers gain if buyers come to see the devices themselves as the weak point.

## What this means

The attack targets what a self-custody user trusts before the first transaction: that a sealed box from an authorized seller holds only what the manufacturer put in it. Holders in Southeast Asia who bought through local resellers are the most exposed. The wider exposure falls on the hardware-wallet business model, which depends on third-party distribution in markets the manufacturer does not serve directly. There is a close precedent. After Ledger's 2020 customer-data breach, tampered devices were mailed to customers in 2021, and in 2023 a compromised Ledger software library briefly drained users. Neither event ended retail self-custody, but both pushed Ledger toward direct sales and tighter controls on its sales channels. The consensus treats this as a reseller problem. That view underrates how hard it is for a buyer to detect a physical implant that leaves the secure chip untouched. The likelier outcome within weeks is that Ledger narrows its authorized-reseller program in the region and expands direct shipping, while large holders move part of their balances to insured or custodial products of the kind Meanwhile sells. That read fails if forensic teardowns show that the device firmware was involved, which would turn a distribution failure into a product failure with much wider consequences.

## What to watch

- Independent teardowns of devices bought from CryptoBilis. A confirmed implant would settle the cause, while clean hardware would reopen questions about Ledger's software or the seed-generation process.
- Whether Malaysian, Indonesian or Philippine authorities open criminal cases against the reseller or its suppliers, which would show whether the theft was organized inside the sales channel.
- Movement of the funds collected at the ten tracked addresses toward exchanges or mixers. This would show whether any of the money can still be frozen.