Ledger probes alleged $86M crypto theft linked to reseller-sold wallets
What's the story
Ledger, a major manufacturer of cryptocurrency hardware wallets, is looking into reports of stolen funds linked to devices sold through a Southeast Asian reseller. The alleged theft could be worth over $86 million and add to the growing list of losses from exploits this year in the crypto industry. Pseudonymous blockchain investigator Specter reported on X that more than $86 million in crypto may have been stolen from hundreds of wallets.
Investigation underway
Ledger acknowledges missing funds from customers
Ledger has acknowledged reports of missing funds from customers who purchased devices through CryptoBilis, a Southeast Asian reseller.
However, the company did not confirm the reported loss amount or identify the cause.
As a precautionary measure, Ledger has asked CryptoBilis to pause all sales and shipments while its investigation continues.
User guidance
Ledger advises customers against setting up devices
Ledger has advised customers who bought devices from CryptoBilis in the last 90 days not to set them up.
The company also suggested that those who activated their wallets should consider transferring their assets to a new Ledger device with a newly generated recovery phrase.
This advice comes as part of the company's efforts to mitigate potential risks amid its ongoing investigation into the matter.
Tampering details
Users' accounts drained
Reports have surfaced that users of the Ledger crypto wallet have had their accounts drained, possibly due to tampered hardware sold by CryptoBilis.
Photos and videos shared on X and Threads show a small circuit board sandwiched under the screen of one affected user's device.
The implant allegedly intercepts anything displayed on the screen, including the seed passphrase shown during initial setup, before sending that information back to an attacker via an embedded SIM card.
Twitter Post
One of the devices contained an unauthorized hardware implant
Situation Update: Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant. Ledger is reaching out to impacted users as part of the ongoing investigation. If you have information regarding the investigation, please reach out to…
— Ledger Support (@Ledger_Support) October 10, 2026
Attack impact
Supply chain breach
The attack appears to be a supply chain breach mainly affecting users in Southeast Asia and the CryptoBilis reseller.
Ledger has not confirmed if its own systems or wallet technology were compromised in this incident.
The company is still investigating the matter and has not yet confirmed how many users were affected, whether the reported thefts are connected, or how much cryptocurrency was lost.