Ledger, the Paris-based maker of hardware wallets, said Friday it is investigating reports that users in Southeast Asia who purchased devices from a reseller named CryptoBilis have lost funds. As a precaution, the company has asked the reseller to pause all sales and shipments of Ledger devices while the review continues.

Ledger's devices are sold both directly and through third-party resellers.

"As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices," the company's support account wrote on X.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…

— Ledger Support (@Ledger_Support) October 9, 2026

Ledger urged anyone who bought a device from the reseller within the past 90 days not to set it up if they have not yet done so. Customers who have already initialized their wallets should consider moving their assets to a new Ledger signer — the physical device that holds a wallet's keys and signs transactions — protected by a fresh seed phrase, the master backup from which a wallet's private keys can be regenerated. A seed phrase, typically a sequence of 12 or 24 words, confers full control over the funds it protects, which is why rotating it is the standard response to a suspected compromise.

The cause of the losses remains unknown. Ledger did not say what went wrong or how many customers were affected. Hardware wallets are designed to keep private keys offline, out of reach of internet-connected computers and phones, but that protection fails if a device is compromised before it reaches the buyer — for example, if it ships with a recovery phrase an attacker already knows. Because the devices exist precisely so holders can control their own keys rather than delegate custody to an exchange, the chain of custody between manufacturer and buyer sits at the core of the product's promise. The company said no tampering has been confirmed, and it has not disclosed how devices might have been exposed.

The suspected losses may be substantial. Pseudonymous on-chain investigator Specter said they traced theft addresses flagged in reports from Ledger users on X and Reddit and identified inflows from hundreds of victim wallets across Ethereum, Tron and Bitcoin.

There have been a reports on X and Reddit of wallet-draining by Ledger users. I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum TRON, and Bitcoin. Total losses $86M+… pic.twitter.com/c5dhQeAZ0l

— Specter (@SpecterAnalyst) October , 2026

"Total losses $86M+," Specter wrote. Arkham data shared by the investigator shows nearly $87 million held at the flagged addresses, including about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT. Ledger has not confirmed the figure, and it remains unclear whether every theft is connected to the reseller.

The episode is the latest in a bruising stretch for crypto security. Rival wallet maker Trezor has contended with its own setbacks, including customer data exposed in a breach at a shipping partner and, just last month, a breach of its email systems.

Last month, the exchange Bitget lost roughly $387 million in a hack that investigators have tied to North Korea, and blockchain tracking firms Chainalysis and Elliptic have since traced part of the haul. North Korean hackers also spent six months infiltrating the Solana exchange Drift before a $285 million exploit, and Drift has since laid out a plan to repay users. In September, self-described white hat hackers withdrew $320 million in Bitcoin from Blockstream's Liquid sidechain before negotiating with the company. Taken together, the run of incidents has touched both self-custody wallet makers and the exchanges where users entrust funds to a third party — the two main ways crypto holders manage their assets.

Ledger said the pause on sales and shipments, along with the customer guidance, is a precautionary measure pending the results of its investigation. The company has not indicated how long the pause will remain in place, and the investigation's open questions — the cause of the losses, the number of customers affected, and whether any devices were tampered with — remain unanswered.