Ledger CryptoBilis investigation: $86M theft?

Ledger investigates reported thefts from users who bought devices via reseller CryptoBilis. Over $86M may be stolen, but cause remains unconfirmed.

Ledger has opened an investigation into reports that funds were taken from users in Southeast Asia who bought its hardware wallets via third-party reseller CryptoBilis. The Ledger CryptoBilis investigation centers on a pseudonymous blockchain investigator who goes by Specter, who puts the possible total at more than $86 million in crypto, allegedly taken from hundreds of wallets, though neither Ledger nor independent sources have verified that number. What triggered the losses is still unclear, and whether the incidents are linked has not been established.

What happened

Ledger says it is examining reports of stolen funds tied to devices sold through CryptoBilis. Specter, who followed suspected theft addresses across Bitcoin, Ethereum, and Tron, said the activity surfaced after Ledger users aired complaints on X and Reddit. The investigator’s figure of over $86 million has not been independently confirmed, and Ledger has neither verified the amount nor determined what led to the losses.

In reply, Ledger told CryptoBilis to stop all sales and shipments until the investigation concludes. The company also gave customers this advice: anyone who purchased a device from the reseller in the last 90 days should refrain from setting it up. For those who have already activated their wallets, the recommendation is to think about transferring assets to a new Ledger device that comes with a freshly generated recovery phrase.

Why it matters

Ledger ranks among the biggest hardware wallet makers, having sold over 7 million devices globally since it was founded in Paris in 2014. Its products are built to keep private keys offline, giving users a way to hold crypto without depending on exchanges. The present probe involves devices sold through a third-party reseller, not Ledger’s own direct sales channels.

A supply-chain attack is one theory under consideration, in which hardware wallets get altered before arriving at buyers. Under that kind of scenario, an attacker might provide a device loaded with a recovery phrase the attacker already possesses, giving them a way to reach the funds afterward. Even so, nothing has been confirmed stating that tampering with devices or pre-generated recovery phrases was behind the reported losses. Equally important, no verified proof exists that Ledger’s own systems or wallet technology were breached.

The timing stands out. A month ago, crypto exchange Bitget was hit by an exploit that led to more than $350 million in stolen assets. Other significant incidents so far this year include Liquid Network at roughly $320 million, Drift at $295 million, and Kelp at $293 million, as reported by DefiLlama. Although these cases are distinct from one another, they highlight the ongoing security difficulties the crypto sector faces.

Market reaction

As of now, the live market shows Bitcoin (BTC) at $82,817.00, up 0.57% in the last 24 hours, with a 24-hour volume of $37,478,559,414 and a market cap of $1,664,295,536,414. Ethereum (ETH) is trading at $2,485.68, down 1.37%, with a volume of $16,269,435,721 and a market cap of $303,553,810,726. TRX is at $0.332567, down 0.57%, with a volume of $359,401,510 and a market cap of $31,583,799,416. The broader market has not shown a dramatic reaction to the Ledger news, but traders often monitor such incidents for potential spillover effects on sentiment.

What to watch next

Ledger has stated it will share updates as the Ledger CryptoBilis investigation moves forward. Several key questions are still open: How many users were impacted? How much crypto was actually lost? Were the incidents connected? And what was the root cause? Until those answers come to light, the situation stays fluid.

For holders, the immediate takeaway is to follow Ledger’s advice if you purchased a device from CryptoBilis in the last 90 days. If you have already activated a wallet from that reseller, consider migrating your assets to a new device with a fresh recovery phrase. As always, never share your recovery phrase, and be cautious of unsolicited messages claiming to be from Ledger support.

FAQ

What is the Ledger CryptoBilis investigation about?

The Ledger CryptoBilis investigation is looking into reports of stolen funds from users in Southeast Asia who bought Ledger devices through reseller CryptoBilis. A pseudonymous investigator estimates more than $86 million may have been taken, but the amount and cause remain unconfirmed.

Why did Ledger ask CryptoBilis to pause sales?

Ledger asked CryptoBilis to halt all sales and shipments while the investigation continues. This precaution aims to keep potentially affected devices from reaching additional customers.

How can I protect my crypto if I bought a Ledger from CryptoBilis?

If you purchased a device from CryptoBilis within the past 90 days, do not set it up. If you have already activated it, consider moving your assets to a new Ledger device with a newly generated recovery phrase. Stay alert for phishing attempts.

Market snapshot

Prices at the time of writing (Oct 9, 2026 15:10 UTC).

Bitcoin (BTC): $82,817.00 — 24h +0.57%
Ethereum (ETH): $2,485.68 — 24h -1.37%
TRX (TRX): $0.332567 — 24h -0.57%

Trade BTC now →

Ledger CryptoBilis Investigation: $86M Stolen?