Ledger is investigating reports of cryptocurrency theft involving customers who purchased hardware wallets from CryptoBilis, a reseller operating in Southeast Asia. The reports emerged after blockchain investigator Specter identified approximately $86.96 million in suspicious transfers across 98 addresses on multiple blockchain networks.

Ledger has asked CryptoBilis to halt all sales and deliveries while the investigation proceeds. In its October 9 press release, Ledger Security also issued security guidelines for customers who recently acquired devices through the reseller. Ledger Support announced the suspension in a post on X.

"Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…" — Ledger Support (@Ledger_Support) October 9, 2026

https://x.com/Ledger_Support/status/2108551100613714002?ref_src=twsrc%5Etfw

Despite the suspected compromise, no hardware flaw has been linked to the incident. There is still no confirmation of how the wallets in question were breached, and it remains unclear whether a single cause explains the losses.

Why Did Ledger Suspend CryptoBilis Sales?

According to Ledger, the company received alerts about missing funds from customers in Southeast Asia who had purchased its products through CryptoBilis. Ledger described the suspension as a precautionary measure and ordered an urgent halt to the sale and delivery of devices from the reseller pending the results of its investigation.

Hardware wallet makers typically reach customers through both official storefronts and third-party resellers, which means a device can pass through hands beyond the manufacturer's direct oversight before it reaches its owner. Whether that distribution channel played any role in the reported losses is among the questions the investigation has yet to answer.

Customers who acquired devices from CryptoBilis within the previous 90 days were asked not to activate any unused wallets. Those who had already activated their devices were encouraged to consider moving their funds to another Ledger signer protected by a different recovery phrase.

The measures form part of the security steps taken by the company amid growing concern among hardware wallet users. At this stage, however, Ledger has not revealed any evidence of device manipulation or identified the source of the breach.

How Much Crypto Was Reportedly Stolen?

Specter, a blockchain analyst, estimated the losses at $86.96 million after analyzing 98 addresses. The estimate followed numerous complaints from users about unauthorized withdrawals from wallets connected with Ledger devices, with reports of wallet-draining circulating on X and Reddit.

"There have been a reports on X and Reddit of wallet-draining by Ledger users. I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin. Total losses $86M+… pic.twitter.com/c5dhQeAZ0l" — Specter (@SpecterAnalyst) October 9, 2026

https://x.com/SpecterAnalyst/status/2108534068564373687

The reported thefts spanned the Bitcoin, Ethereum, and TRON networks. Specter traced transfers from hundreds of victim wallets, but it remains unclear how many customers have been affected.

Previously, security researcher tanuki42 estimated the losses at more than $72 million. That figure is lower than Specter's calculation, although neither estimate represents total loss officially confirmed by Ledger. Diverging figures are common in the early stages of on-chain investigations, when independent analysts trace fund flows before any official accounting exists.

It is also important to note that 98 addresses do not equate to 98 victims. There has been no confirmation that all of the suspicious transactions were carried out by CryptoBilis customers. Two distinct questions therefore remain open in connection with the case: how the wallets were compromised, and whether every affected user purchased a device through the reseller.

Can Crypto Be Stolen Without a Ledger Device?

Hardware wallets protect private keys by operating in isolation from internet-connected systems. Transactions must be approved on the device itself, which limits the scope for remote attacks.

A wallet's recovery phrase, however, allows the wallet to be recreated elsewhere, which is why protecting the phrase is central to hardware wallet security. For Ledger devices, the recovery phrase consists of 24 words that back up the wallet's private keys. Anyone who gains access to those 24 words can restore the wallet without ever holding the hardware. A passphrase, when properly configured, can provide additional protection for individual accounts.

This is one way crypto can be stolen without physical access to the hardware in question. Nevertheless, it has yet to be determined whether recovery phrase theft lies behind the reported losses.

What Should Ledger Users Do Next?

Ledger's account security guidance warns customers never to disclose recovery phrases through websites, apps, or any form of message.

Customers who bought devices from CryptoBilis within the 90-day window should follow the company's instructions. Those considering moving their assets should generate a new recovery phrase using a trusted device and verify the destination address before transferring funds.

The investigation remains ongoing. Its eventual findings, along with any revised loss estimates as on-chain tracing continues, are the developments most likely to resolve the open questions in this case. The estimated losses have raised security concerns, but they have not established any defect in Ledger hardware wallets.