Ledger is investigating a major cluster of wallet drains affecting customers in Southeast Asia who purchased hardware wallets from the reseller CryptoBilis, with the latest onchain estimate placing suspected losses at $92.9 million.

Hardware wallet security rests on a single premise: the recovery seed — the phrase that controls access to onchain funds — is generated on the device itself and never leaves it. That is why the sales channel through which a device reaches its buyer sits at the center of this case.

The company asked CryptoBilis to halt all Ledger sales and shipments on October 9 while the investigation continues. Anyone who bought a device from the reseller during the previous 90 days and has not yet initialized it should not begin setup. Customers already using one of the devices were advised to consider moving their assets to a new Ledger signer generated with an entirely new recovery seed.

In updates posted by its support account on X, Ledger said the reports identified so far were limited to devices distributed through CryptoBilis and that it had no indication its security infrastructure, systems or services had been compromised. The company has not confirmed the amount stolen, the number of victims, or the mechanism used to gain access to the wallets.

CryptoBilis Changed Ownership Months Before the Drains

CryptoBilis was acquired earlier in 2026, former co-founder Arravind Prabu confirmed after the wallet-drain investigation began. Prabu said the former owners fully stepped down from operations, system access and management after the acquisition and no longer operate CryptoBilis. The transaction was completed in March, while Malaysian corporate records published the investigation show an individual identified as Jiaming, with a registered address in Heilongjiang, China, holding 100% of CryptoBilis shares as of August 3.

Security researcher Quit said the acquisition included a non-disclosure agreement that prevented the previous owners from publicly revealing the sale, with the restriction due to expire on October 19 — ten days after Ledger's halt request. He raised the possibility that the purchase could have been carried out by a sophisticated threat actor seeking access to an established authorized reseller, rather than the incident originating from a rogue employee. The theory reflects the trusted position resellers occupy between manufacturer and customer.

That remains an investigative theory. No public evidence has established that the new owner acquired CryptoBilis to compromise Ledger devices, participated in the wallet drains, or had any connection to the attacker-controlled addresses. The timing nevertheless places the change of ownership months before the affected devices were sold and before the coordinated drains began.

Onchain Estimate Reaches $92.9 Million

Suspected losses have expanded beyond initial estimates of $72 million to $86 million as investigators identified additional affected addresses and networks.

A detailed Bitquery reconstruction of the drain identified $92.9 million taken from 311 wallets across Tron, Bitcoin, Ethereum, BNB Chain and Polygon. The largest losses were concentrated on Tron, where approximately $70.5 million was removed. Bitcoin wallets lost about 203.8 BTC worth $16.8 million, while Ethereum, BNB Chain and Polygon accounted for the remaining funds.

The transaction timing points to centralized control over the affected private keys. Twenty-five Tron wallets authorized the same spender within three seconds, and 111 Bitcoin wallets were emptied within a single block, according to reports shared on X. Bitquery also traced 41 small test transactions across Tron and Ethereum during the two weeks preceding the main drain. That pattern does not establish how the private keys were obtained, but it differs from individual victims independently approving malicious transactions over an extended period.

Tether subsequently froze approximately $10 million in USDT across 20 addresses connected to the activity — a step available to the issuer because stablecoin balances can be frozen at designated addresses. Another 15.1 million USDD remained in attacker-controlled wallets, while 1,254 ETH was sent through Tornado Cash, a mixing protocol built to obscure the link between depositing and withdrawing addresses, later on October 9. Roughly $79 million remained traceable at the latest analysis.

Physical Implant Raises Supply Chain Questions

A possible hardware-based attack route is also under examination. Former Mt. Gox CEO Mark Karpelès opened a Ledger device obtained from Malaysia and reported finding a concealed electronic implant positioned where screen padding would normally sit.

Karpelès said the modified device retained convincing packaging and that the implant was difficult to spot even after the case was opened. His analysis indicated the additional hardware could monitor information displayed during setup and transmit recovery phrase data externally. A modification of that kind would target setup itself — the moment a recovery phrase is first generated and displayed.

No public evidence has yet established that the device inspected by Karpelès came from CryptoBilis or that the same modification caused the $92.9 million drain. Ledger has also not confirmed a supply-chain attack.

The technique resembles risks exposed earlier this year, when a counterfeit Ledger containing hidden hardware was found capable of targeting recovery phrases and PIN information. The current case is also distinct from the Coldcard wallet drains earlier in 2026, where investigators traced the losses to weak seed generation in affected firmware rather than reseller-level hardware modification.

Ledger's warning currently applies specifically to customers who purchased devices from CryptoBilis within the last 90 days. Users who already initialized one of those devices need a new signer and a newly generated seed, rather than simply moving the existing recovery phrase onto another hardware wallet — a phrase exposed during setup remains valid on any device it is later loaded onto. With the mechanism still unconfirmed, both the final loss total and the attack route remain open to revision as the investigation continues.

Source: Crypto Adventure