Ledger is investigating more than $86 million in reported cryptocurrency losses tied to users in Southeast Asia who purchased hardware wallets from the reseller CryptoBilis. The affected devices are suspected of having been counterfeit or tampered with before they reached customers, and the company has instructed the reseller to suspend sales and shipments while its inquiry continues.

The probe follows a wave of reports on X and Reddit from Ledger users describing wallet-draining incidents. On October 9, 2026, on-chain analyst Specter traced stolen funds across Ethereum, TRON, and Bitcoin, identifying inflows from hundreds of victim wallets. The findings point toward a possible supply chain attack confined to a single reseller, rather than a vulnerability affecting Ledger hardware wallets across the board. Binance founder Changpeng Zhao, widely known as CZ, also issued a warning to users who recently purchased Ledger devices.

How the Suspected Hardware Wallet Compromise May Have Occurred

Ledger is one of the most widely used hardware wallet manufacturers, and its devices are designed to keep private keys offline, reducing their exposure to internet-based attacks such as phishing and malware. The reported incident raises questions about how compromised hardware wallets can expose cryptocurrency holdings, because that protection depends entirely on users receiving genuine devices that have not been manipulated before delivery.

If counterfeit or tampered devices were distributed through a reseller, attackers could potentially compromise wallet security before customers ever began using the products. Third-party resellers sit between the manufacturer and the buyer in the distribution chain, which is why hardware wallet security guidance has long steered buyers toward official or authorized sales channels. The information available so far does not establish exactly how the suspected devices enabled the reported thefts. Ledger's investigation will need to determine the method of compromise and identify which products were affected.

Specter's on-chain analysis identified multiple theft addresses receiving funds from victims across three major blockchain networks.

There have been a reports on X and Reddit of wallet-draining by Ledger users. I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin. Total losses $86M+… pic.twitter.com/c5dhQeAZ0l

— Specter (@SpecterAnalyst) October 9, 2026

Post: https://x.com/SpecterAnalyst/status/2108534068564373687?ref_src=twsrc%5Etfw

The identified addresses include Bitcoin addresses beginning with bc1q, TRON addresses beginning with T, and Ethereum addresses beginning with 0x. This cross-chain activity suggests that the reported losses extend beyond a single cryptocurrency.

The scale of the incident remains significant, with reported losses exceeding $86 million. The available information does not, however, provide a final breakdown by blockchain, a confirmed count of victims, or the total amount recovered to date.

What Ledger Users Should Know

Ledger's instruction to CryptoBilis to pause sales and shipments represents a precautionary response while the investigation proceeds. It does not establish that Ledger's entire hardware wallet product line has been compromised. CZ similarly characterized the evidence gathered so far as pointing toward a localized supply chain attack involving one vendor, rather than a flaw affecting Ledger devices generally.

Beware if you use a Ledger hardware wallet, especially if you bought one recently. Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers. Ledger is one of the most…

— CZ BNB (@cz_binance) October9, 2026
n> Post: https://x.com/cz_binance/status/2108558560560918852?ref_src=twsrc%5Etfw

For cryptocurrency holders, the incident highlights a security risk that extends beyond software vulnerabilities and exchange breaches: the physical supply chain through which devices reach buyers. Purchasing hardware wallets through trusted channels can help reduce exposure to counterfeit products, and users should follow official manufacturer guidance when verifying devices and setting up wallets.

Anyone concerned about a recently purchased device should avoid entering an existing recovery phrase into unverified software or websites. A recovery phrase provides direct access to the funds controlled by a wallet, meaning anyone who obtains it can take the associated balances. Users who suspect their device may be compromised should follow official security guidance and consider moving assets to a verified, secure wallet.

The Role of Blockchain Analysis

The investigation also underscores the role of blockchain analysis in tracing stolen cryptocurrency across networks. Because public blockchains record every transaction, analysts can follow the movement of stolen funds even after they leave victims' wallets. Specter identified multiple addresses associated with the reported thefts, giving investigators potential leads for tracking fund movements. CZ said he expects industry participants to help trace and recover the assets. Tracing, however, is generally a first step rather than an endpoint; recoveries in crypto theft cases typically depend on exchanges and service providers flagging or freezing deposits tied to identified theft addresses.

For now, the key distinction lies between a suspected reseller-level compromise and a confirmed vulnerability in Ledger's broader hardware wallet systems. The investigation must still establish how the devices were compromised, how many users were affected, and whether any of the stolen funds can be recovered. The next concrete updates are likely to come from Ledger's continuing inquiry and from analysts tracking the identified addresses.