Ledger Investigates $86M Wallet Drain Linked to Reseller

Ledger Investigates $86M Loss Following Drained Wallet Reports

Hardware wallet manufacturer Ledger announced an investigation on Friday, October 9, 2026, after users reported tens of millions of dollars in cryptocurrency missing from their wallets.

Total known losses across several blockchains have passed $86 million. The company is now warning customers against activating devices purchased from a specific reseller.

Where Did the $86 Million Go?

Onchain investigators quickly began tracking the stolen funds across Bitcoin, EthereumETH-0.36%, TronTRX-0.71%, and other blockchains.

Data compiled by an investigator known as Specter shows that Ethereum holders took the largest hit, with over $42 million in ETH drained from affected wallets.

The reported losses also included $17.5 million in Bitcoin (BTCBTC+1.06%) and $16.5 million in TetherUSDT-0.21%. This brought total confirmed losses above $86 million by Friday morning.

The Primary Suspect: A Localized Supply Chain Incident

Ledger posted an official statement on X early Friday to address community concerns. The company suggested the security breach might be limited to devices sold by a reseller in Southeast Asia.

Ledger confirmed it is investigating reports of lost funds from users in Southeast Asia who bought products from a reseller named Crypto Bilis.

As a safety precaution while the investigation is ongoing, Ledger asked Crypto Bilis to pause all sales and shipments of Ledger devices immediately.

Upset Users Share Their Experiences

Social media channels quickly filled with posts from affected Ledger owners. Many claimed their funds disappeared even though they kept their recovery phrases offline and never signed malicious transactions.

One affected user shared their experience on Reddit, explaining how they lost nearly $100,000 in USDT from a device that was only used to receive funds.

My Ledger wallet just got drained out of almost 100k USDT. Seed phrase [was] handwritten and kept in a safe. Never touch my Ledger Stax. The Ledger wallet was used as a place to keep funds, and I dont interact with anything other than receiving funds.

Important Safety Steps for Ledger Owners

If you recently bought a Ledger device from the affected vendor, the company recommends taking immediate protective actions.

Ledger issued specific guidelines for customers who purchased a device from Crypto Bilis over the past 90 days:

• If you purchased from this reseller in the last 90 days, do not initiate device setup if you have not done so yet.
• If you have already set up your device, consider moving your assets to a new Ledger signer generated with a brand-new seed phrase.

Ledger stated it will continue to provide updates to customers as its internal investigation moves forward.

What Do Security Experts Say?

The news triggered concerns across the crypto community. However, industry experts clarified that this incident does not appear to indicate a flaws in all Ledger hardware.

Binance co-founder and former CEO Changpeng Zhao (CZ) shared his thoughts on X, pointing out that the issue looks like a supply chain attack involving tampered hardware.

Based on information so far, it seems to be localized to a supply chain attack with one vendor. A small number of people probably bought fake (or tampered) Ledgers. Ledger is one of the most secure and oldest hardware wallets in the industry. Stood the test of time. But these things happen.

Understanding Supply Chain Risks in Crypto Wallets

A supply chain attack happens when a bad actor tampers with physical hardware before it reaches the end customer. This can involve modifying internal chips or pre-configuring device recovery phrases.

Hardware wallets remain a popular choice for storing digital assets, but buying through verified, direct channels helps reduce risk. Past performance of digital assets or security hardware is not a guarantee of future safety, and investors should manage wallet risks carefully.