The hardware-wallet maker told anyone who bought from CryptoBilis in the past 90 days not to set up their devices, and said its own systems were not compromised. Tether froze part of the stolen stablecoins; the bitcoin and ether cannot be frozen the same way.
October 9, 2026
Tickers: BTC, ETH, USDT, TRX
The weakest point in a hardware wallet may be the route it takes to reach the buyer.
Ledger, the French maker of hardware wallets used to store crypto offline, said on Friday that it is investigating reports of lost funds from customers in Southeast Asia who bought devices from CryptoBilis, an authorized reseller serving Indonesia, Malaysia and the Philippines. Ledger said it asked CryptoBilis "to pause all sales and shipments."
What Ledger told customers
Ledger advised anyone who bought from CryptoBilis in the past 90 days not to initialize their device. "If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed)," the company said.
It also drew a line around its own operations. "No reports were made of products purchased directly from Ledger, and Ledger's infrastructure, systems and services were not compromised," the company said. Ledger did not give a loss figure or say how the funds were taken.
The losses
An on-chain investigator who traced theft addresses across the Bitcoin, Ethereum and Tron networks estimated total losses at more than $86 million, drawn from hundreds of wallets. Ledger has not confirmed a figure.
The largest single loss identified so far was 7 million of the USDT stablecoin, taken from a user who had bought a device from the reseller about three weeks earlier. Another victim lost 80 bitcoin, worth about $6.6 million at Friday's prices. About 430 ether, roughly $1.1 million, has been sent to Tornado Cash, a service used to obscure the trail of funds.
The freeze
Tether, the issuer of USDT, froze tokens held at some addresses linked to the thefts. The amount frozen has not been disclosed. Some of the stolen USDT was converted into another stablecoin, USDD, after the freeze.
That split illustrates a structural difference. A centralized stablecoin issuer can block transfers from specific addresses; nobody can do that for bitcoin or ether. Freezing also does not return money to victims, which usually requires a legal process or a coordinated recovery.
How it happened
The cause is not known. One possibility is that devices sold through the reseller were tampered with, or shipped with recovery phrases the attackers already knew. Another is that customer data leaked from the reseller and buyers were targeted with phishing. Binance founder Changpeng Zhao described the incident as a supply-chain attack at one vendor. Trezor, a rival wallet maker, said it reviewed its own distribution and found no similar issues.
Two readings
One reading is that this is a contained distributor failure. Ledger's systems were not breached, no direct purchases are affected, the reseller has been stopped and recent buyers have been told what to do.
A second reading is that the "authorized reseller" safeguard that self-custody advice relies on has failed, and that the scale, more than $86 million in days, shows how a single weak link in a supply chain can defeat the protection hardware wallets are meant to offer.
What comes next
A root-cause report from Ledger, a confirmed loss total, the amount Tether has frozen and any reports tied to other resellers or regions are the next markers.