Ledger, the manufacturer of hardware cryptocurrency wallets, is currently looking into reports of users in Southeast Asia losing funds after purchasing devices from the reseller CryptoBilis.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBilis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses. Reach out to Ledger customer support through official channels with any questions: https://t.co/4p918UH8yb

— Ledger Support (@Ledger_Support) October 9, 2026

During the investigation, Ledger has requested CryptoBilis to halt all sales and shipments of its products.

In a statement dated October 9, Ledger advised customers who bought devices from CryptoBilis in the past 90 days not to set up their wallets yet. Those who have already activated their devices should consider transferring their assets to a new Ledger wallet with a different seed phrase.

CryptoBilis is listed as an authorized Ledger reseller in Indonesia, Malaysia, and the Philippines.

Source: Ledger.

As of now, the cause of the incident remains unclear. Ledger has stated that its infrastructure, systems, and services have not been compromised and that there have been no reports of issues with devices purchased directly from the manufacturer.

Potential Losses Could Exceed $86 Million, Though Not Confirmed

On-chain researchers have reported suspicious transfers from wallets across multiple blockchains. An analyst known as tanuki42 linked addresses that received over $72 million to the alleged thefts.

If you were just drained to any of the following addresses, please can you reach out to @SEAL_911 asap. Total loss is >$72M+ and increasing. TK6DWNpNe1w2iJRNFpU8aHdrPTATxvXT6C TBkcUMYC7CkTK99tkTnaStQVBastfrs9d9 TCGE3xp6YGRKXxDZiLfysgJW3f22KfMNsW TSDWtuZ2pARUVz4v3PkL2hi3iXPjowAr5a bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl 0x83aeac166f6832ae3500000a24510a95a052a599 0x033636e45d519bebb7b5c2520ca6ce56fbdb4f7a 0x69c8f401cfc6cd40ac94691d6d7c48e3b7a47841

— tanuki42 (@tanuki42_) October 9, 2026

Another researcher, Specter, estimated the total potential losses could exceed $86 million in Bitcoin, Ethereum, and TRON.

These figures have not been confirmed by Ledger and do not represent a definitive amount of losses. It remains unclear whether these estimates refer to the same transactions and how many of the identified cases are linked to CryptoBilis.

Researchers Discover Potential Hardware Implant

Further context was provided by a study from Tibane Labs, which examined two Ledger Nano X devices that were suspected of containing hardware implants. The researchers suggested that such devices could intercept data transmitted between the secure chip of the wallet and its screen.

Source: Tibane Labs.

During the initial setup, the wallet displays 24 recovery words to the user. The implant described by Tibane Labs reads these words from the screen signals, recognizes them, and transmits them to an attacker via a built-in cellular module.

This means the secure element responsible for storing keys and signing transactions is not compromised. Instead, the implant intercepts information along the path to the screen, so verifying the authenticity of the secure chip alone may not reveal such an intrusion.

Tibane Labs detailed several generations of the implant, ranging from early designs with visible wires to more compact boards disguised as original electronics. In one of the examined units, the standard battery remained, while additional components were hidden beneath the screen.

However, this research does not prove that such implants were used in the devices sold by CryptoBilis. Tibane Labs noted that one of the Nano X units was purchased from Japanese Yahoo! Auctions, while the other was bought from a third-party seller on Amazon Japan, with the shipment originating from Malaysia. Experts did not establish a direct connection between these units and Ledger's investigation.

Tibane Labs also pointed out that former co-founders of CryptoBilis informed them about the transfer of the business to new owners in March 2026 and stated that they no longer had access to the company's systems afterward.

Did Karpelez Avert a Major Theft?

Mark Karpelez, the former CEO of the bankrupt Bitcoin exchange Mt. Gox, shared a link to the Tibane Labs study on his X platform account on October 8.

Bitcoin News speculated that hackers who placed implants in Ledger wallets might have been gathering data with the intention of draining the devices en masse. However, a warning from the Japan-based entrepreneur may have disrupted their plans and prompted them to withdraw the funds they had accessed.

Experts from Tibane Labs noticed that components from later versions of the implants appeared to be manufactured on a large scale. The marking on one of the parts ended with the symbols v1.1, indicating that it underwent modifications.

It is worth noting that in September, Ledger faced a class-action lawsuit due to an alleged data leak in 2023.

Follow ForkLog on social media

Telegram (main channel) Facebook X