Ledger has launched an investigation into a wave of reported customer fund losses across Southeast Asia, with the common thread pointing to hardware wallets purchased through CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia, and the Philippines.

Ledger's guidance to customers

The hardware wallet maker announced the probe on October 9, 2026, and instructed CryptoBilis to stop all sales and shipments immediately.

Instructions for buyers depend on whether the device has been opened. Customers who purchased from the reseller within the last 90 days and have not yet set up their device should leave it uninitialized, the company said. Those who have already created a wallet are being urged to move their assets to a new Ledger device that generates a completely fresh seed phrase. The urgency reflects how hardware wallet security works: the recovery phrase produced at setup is the ultimate control over the funds, and anyone holding it can access a wallet from any compatible device, no original hardware required.

Ledger has drawn a firm line around its own infrastructure, stating that its systems and the devices it sells directly have not been compromised — a boundary that does not extend to stock that moved through third-party channels such as CryptoBilis.

The alleged spy hardware

The tampering theory took shape on social media. Photos and videos posted on X and Threads appear to show a small circuit board tucked beneath the device's screen.

According to those posts, the implant allegedly captures whatever appears on the display — including the recovery phrase shown during initial setup, the moment at which a wallet is most exposed. That screen is designed to serve as the trusted surface users rely on to verify what a device is doing, which is what puts an allegedly display-reading component at the center of the concern.

The board reportedly carries an embedded SIM card. The claim is that it relays captured data over a cellular connection straight to the attacker, who can then empty the victim's wallet at leisure.

Mark Karpelès, the former CEO of Mt. Gox — the Tokyo exchange that collapsed in 2014 after losing hundreds of thousands of customers' bitcoins — examined some of the suspect devices and has called for further investigation.

As of October 10, 2026, no definitive link had been confirmed between the alleged hardware tampering and CryptoBilis, and the investigation remains open.

How much may have been taken

The dollar figures come from on-chain analysts rather than from Ledger. Analytics outfits Specter and tanuki42 flagged a pattern of inflows to suspected theft addresses across multiple blockchains, with loss estimates ranging between $72 million and $93 million.

Arkham Intelligence tracked around $87 million across various wallets at one point. The holdings reportedly include significant amounts of Ethereum (ETH), Bitcoin (BTC), and Tether (USDT).

Ledger has not confirmed any of these numbers.

Tether froze approximately $10 million in USDT linked to some of the alleged theft addresses, a lever available because USDT is a centrally issued token whose issuer can freeze balances at specific addresses.

CryptoBilis was reportedly linked to a recent change in ownership connected to an individual from China. No wrongdoing tied to that ownership change has been established.

What this means for wallet buyers and Ledger

For anyone holding a Ledger bought through CryptoBilis, the practical steps are clear: follow the company's guidance, move funds to a fresh device with a new seed phrase, and do not wait for the investigation to finish.

The key things to watch are whether investigators confirm a physical link between the implants and CryptoBilis, whether Ledger publishes its own loss figures, and whether more issuers follow Tether in freezing linked funds.