"We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet," Ledger said in an X post.
Ledger opens investigation after reports of stolen funds
Cryptocurrency hardware maker Ledger said it is investigating reports of lost funds tied to devices sold by the reseller CryptoBilis. The company temporarily paused sales of its products via CryptoBilis and advised customers who purchased from that reseller in the past 90 days not to set up affected devices. Ledger additionally recommended that users who have already set up a device "consider moving assets to a new Ledger signer (with new seed)." Ledger said it is reaching out to impacted users as part of an ongoing probe.
Unauthorized hardware implant found in at least one device
As part of its public updates, Ledger revealed that one of the impacted users' devices contained an unauthorized hardware implant. The company described the situation as an active investigation and characterized the number of affected devices as "limited" in a follow-up update posted on October 11, 2026. Ledger said all confirmed cases involve devices sold through CryptoBilis.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageCryptoBilis halts sales and warns customers about recovery phrases
Out of an abundance of caution, CryptoBilis has ceased sales of all hardware wallet inventory until the investigation is concluded. On its website the reseller posted a customer alert emphasizing how recovery phrases must be handled: "Your recovery phrase must be generated by your device when you set it up, and written down by you," the alert reads. The reseller cautioned users that if a device came with a recovery phrase already printed or written on a card or sheet, or if anyone other than the buyer has seen the recovery phrase, the device should be treated as unsafe.
CryptoBilis reiterated typical industry warnings in the same notice: "Never share your recovery phrase or PIN with anyone. No one from CryptoBilis or Ledger will ever ask for them. Be careful of anyone who offers to recover lost funds; these offers are almost always scams."
Specter reports more than $86 million in losses; geographic focus in Southeast Asia
The financial impact has been quantified publicly by the pseudonymous blockchain investigator Specter, who reported losses totaling more than $86 million. Ledger said the reports concern users in Southeast Asia who purchased products from CryptoBilis. Ledger's October 11 update described the affected set of devices as "limited" and reiterated that all confirmed cases to date involve purchases made through the reseller.
What this means for resellers, end users, and security teams
- Resellers and distributors: Ledger advised resellers and distributors to source products only through authorized channels and never to restock returned products. CryptoBilis has stopped selling hardware inventory while the probe continues.
- End users who bought from CryptoBilis: If you purchased a Ledger device from CryptoBilis in the last 90 days, Ledger advised against initiating setup. If you already completed device setup, Ledger recommended moving assets to a new Ledger signer with a newly generated seed. CryptoBilis warned users to treat any device with a preprinted recovery phrase as unsafe and to refuse requests to share recovery phrases or PINs.
- Security teams and investigators: Ledger is conducting an ongoing probe and contacting impacted users. The company disclosed that at least one device contained an unauthorized hardware implant, a detail investigators and buyers will likely focus on as the inquiry continues.
The immediate facts are straightforward: Ledger has paused sales through CryptoBilis, CryptoBilis has halted all hardware wallet sales pending the investigation, an unauthorized hardware implant was found in at least one affected device, and a pseudonymous investigator has linked the incident to more than $86 million in reported losses concentrated among purchasers in Southeast Asia. Ledger and CryptoBilis have issued firm, practical warnings about recovery phrases and purchasing channels, and Ledger has asked resellers to source through authorized distributors and not to restock returned units. The investigation is ongoing; Ledger is contacting impacted users and public updates — including the October 11, 2026 follow-up — indicate the company views the confirmed cases as limited and tied to CryptoBilis sales.
How the probe resolves — whether additional devices or channels will be implicated, how many individual users were affected, and what remedial steps buyers can expect beyond the immediate setup and seed-replacement advice — remains to be determined as both companies continue their investigations.
