Ledger investigates stolen funds linked to a Southeast Asian reseller

Quick answer: Ledger says it is investigating reports of missing funds from people who bought its hardware wallets through CryptoBilis, a reseller in Southeast Asia. The total and the cause are not confirmed. If you bought a Ledger from that reseller in the last 90 days, do not set it up. If you already use one, follow Ledger's advice below.

What was reported

• 9 Oct 2026: Ledger said on X that it is investigating reports of stolen funds from customers who bought devices through CryptoBilis. It asked the reseller to pause all sales and shipments (REPORTED, CoinDesk and The Defiant).
• An on-chain investigator known as Specter estimated that more than 86 million US dollars may have been taken from hundreds of wallets on Bitcoin, Ethereum and Tron. This figure has not been independently confirmed (REPORTED, CoinDesk).
• Ledger has not confirmed the amount or the cause, and says there is no confirmed evidence that its own systems were compromised (REPORTED, CoinDesk).

What Ledger advises

• If you bought a device from CryptoBilis in the past 90 days and have not set it up, do not set it up yet.
• If you already set one up, consider moving your funds to a new Ledger bought directly from Ledger, with a newly generated recovery phrase (REPORTED, from Ledger's statement as quoted by CoinDesk).

What we still can't confirm

• How much was taken, and from how many people.
• Whether the reported thefts are connected to each other.
• The cause. A tampered device sold with a recovery phrase the seller already knows is one possible explanation, but nobody has confirmed it.
• We have not read Ledger's post directly, so every point above stays REPORTED.

What to do

1. Buy hardware wallets only from the maker's own store or a reseller the maker lists on its website.
2. A new device must make you create a new recovery phrase. If the box already contains a phrase or a scratch card with words, do not use it. Contact the maker.
3. Never type your recovery phrase into a website, an app or a chat. Ledger, MintGraph and real support staff will never ask for it.
4. Watch for fake "Ledger support" or "compensation" messages after this news. They are a common follow-up scam.
5. More on staying safe: Telegram airdrop scams: 7 signs and what a wallet approval is.

GuideTelegram airdrop scams: 7 signs and what to do→

GuideWhat is a wallet approval, and how to revoke one→

This is research and safety guidance, not financial advice. We will update this note when Ledger publishes its findings.