Ledger Pauses Reseller CryptoBilis After Reports of $86 Million in Drained Wallets

Ledger said on Friday, October 9, 2026 that it is investigating reports of lost funds from users in Southeast Asia who bought its hardware wallets from a reseller called CryptoBilis, and that it has asked the shop to pause all sales and shipments of Ledger devices. The move came about an hour after on-chain analyst Specter claimed that wallets belonging to Ledger users had been drained of more than $86 million across Ethereum, TRON and Bitcoin. Ledger has not confirmed that figure or said how the funds were taken.

Key takeaways

• Ledger's action covers one reseller, CryptoBilis, and buyers from it in the last 90 days.
• The $86 million total is an analyst's tally from public blockchain data, not a Ledger number.
• Three bitcoin addresses on the analyst's list had received about 211 BTC, none of it moved as of 14:20 UTC.
• Nobody has shown yet whether the devices were tampered with, or how the keys were exposed.

What did Ledger say?

In a post from Ledger Support at 13:32 UTC, Ledger said it was looking into the reports and had asked CryptoBilis to stop selling and shipping its devices while the investigation runs.

The company told anyone who bought from that reseller in the last 90 days not to set the device up if they haven't yet. Buyers who already set one up should consider moving assets to a new Ledger signer with a new seed, Ledger said. It promised further updates as the investigation progresses.

BeInCrypto reports that CryptoBilis is a Malaysian shop founded in 2020 that also operates in Indonesia and the Philippines.

Where does the $86 million figure come from?

Three posts on X built the number. At 12:00 UTC, investigator tanuki42 listed eight addresses, put losses above $72 million and asked victims to contact SEAL 911. The Security Alliance amplified that list at 12:29 UTC.

At 12:24 UTC, Specter posted 10 addresses, said they traced inflows from hundreds of victim wallets and put total losses at $86 million or more. Specter's list includes tanuki42's eight plus two more bitcoin addresses.

Unchained reported that the 10 addresses held only a little over $25 million at last check, which suggests most of the money has already moved. None of the posts says how the funds were taken. These are allegations built from on-chain tracing, and the totals could change.

Was bitcoin affected?

Yes, according to the analysts. Three of Specter's 10 addresses are on the Bitcoin network. Public data on mempool.space shows those three had received about 211.2 BTC combined, and none of it had been spent as of 14:20 UTC. With bitcoin at $82,989 at that time, per Yahoo Finance, that's roughly $17.5 million.

The thefts hit several chains at once, which points at how keys were handled, not at any single blockchain. No report so far suggests a problem with Bitcoin itself.

Why does this matter for self-custody?

A hardware wallet only protects you if the keys inside it were never exposed. If devices from one seller turn out to have been altered before they reached buyers, that's a supply chain problem, and it's exactly the kind of risk self-custody users can't see from the outside. Ledger hasn't said that happened. It has said the risk was serious enough to stop the reseller's sales.

It's also the second big hardware wallet scare in a short stretch, after the Coldcard firmware bug that let attackers drain 594 BTC.

What should Ledger users check, and what's next?

Ledger's guidance, in its own words, is aimed at buyers from CryptoBilis in the last 90 days: don't start setup on an unopened device, and if it's already set up, consider moving assets to a new Ledger signer with a new seed. Ledger asks customers to reach Ledger support only through official channels.

What to watch next:

• The result of Ledger's investigation, and whether it confirms tampering or a different cause.
• How many users and how much money Ledger itself puts on the incident.
• Whether the 211 BTC sitting in the three bitcoin addresses starts to move.
• Any word from SEAL 911 or exchanges on frozen funds.

This is a developing story. 21Rates will update it as Ledger and investigators publish more.