Ledger Probes $86M Theft Linked to Asian Reseller

Investigating an $86 Million Security Incident

On October 9, 2026, popular hardware wallet manufacturer Ledger announced that it is investigating serious reports of stolen user funds. Social media reports on platforms like X and Reddit suggest that over $86 million in cryptocurrency may have been drained from hundreds of wallets.

The suspected security breach appears linked to hardware devices sold by Crypto Bilis, an authorized third-party reseller based in Southeast Asia. Affected users reported unexpected losses across major networks, including BitcoinBTC+1.44%, EthereumETH+0.83%, and TronTRX-0.62%.

Ledger acknowledged customer reports regarding missing funds from devices bought through Crypto Bilis, though the company noted that total losses and direct causes remain unconfirmed.

How the Security Findings Unfolded

The potential theft was brought to light by a pseudonymous blockchain researcher known as Specter. Writing on X, Specter revealed that they began tracking suspicious transaction patterns after observing multiple reports from distressed Ledger users on Reddit and X.

Specter traced suspicious wallet addresses across Bitcoin, Ethereum, and Tron blockchains. Their initial analysis indicates that more than $86 million worth of digital assets may have been taken from hundreds of individual addresses. However, independent security auditors have not yet verified the exact figures or confirmed whether all reported losses stem from the same root cause.

Ledger Action Plan and Advice for Users

Ledger responded by taking immediate action to protect potential buyers. The Paris-based company requested Crypto Bilis to pause all device sales and shipments while the official investigation continues.

For customers who recently interacted with this reseller, Ledger recommends taking the following safety measures:

• Pause setup for recent purchases: Anyone who bought a Ledger device from Crypto Bilis within the last 90 days should hold off on setting it up.
• Move existing assets: Users who have already activated a device purchased through this reseller should consider moving their assets to a new device.
• Generate fresh recovery phrases: When setting up a replacement wallet, always create a brand-new recovery phrase rather than restoring an existing seed phrase.

Understanding Supply-Chain Attacks

While the exact cause of the missing funds remains unconfirmed, industry experts suspect a potential supply-chain attack. Think of a supply-chain attack like ordering a brand-new house lock, but someone intercepts the package in transit, makes a secret copy of the key, and then delivers it to you. Once you install the lock, the bad actor can open your door whenever they want.

In the context of hardware wallets, an attacker might tamper with a device before it reaches the buyer or supply a pre-generated recovery phrase inside the packaging. If a user deposits Bitcoin, Ethereum, or Tron into a compromised device, the attacker can use the copied recovery keys to drain those funds remotely.

Ledger Core Systems Remain Unbreached

It is important to note the difference between third-party reseller tampering and a compromise of Ledger's internal systems. Founded in 2014 and headquartered in Paris, Ledger is a major manufacturer of offline self-custody hardware devices, having sold more than 7 million units globally.

Currently, there is no evidence indicating that Ledger's own software, firmware, or core wallet technology was breached. The active investigation is focused strictly on the supply chain handled by Crypto Bilis.

Broader Security Context in 2026

This incident adds to a series of significant security events recorded across the cryptocurrency industry this year. Data compiled by Defi Llama highlights several major exploits that occurred in 2026:

• Bitget: Experienced a security exploit resulting in over $350 million in stolen assets.
• Liquid Network: Recorded an exploit amounting to approximately $320 million.
• Drift: Suffered losses estimated at around $295 million.
• Kelp: Reported security losses reaching roughly $293 million.

Key Steps to Keep Your Cold Storage Safe

To keep your crypto safe when using hardware wallets, security specialists recommend following basic hygiene practices:

• Buy directly: Order hardware wallets directly from the official manufacturer whenever possible.
• Inspect packaging: Check for signs of physical tampering or broken tamper-evident seals before use.
• Never use pre-filled seed phrases: Authentic hardware wallets always generate random recovery phrases on their built-in screens during setup. Never use a wallet that comes with a printed recovery phrase inside the box.
• Verify device authenticity: Connect new devices to official companion apps to verify hardware integrity before depositing funds.

Ledger stated that it will share further updates as its technical investigation progresses.