Buying a hardware wallet is supposed to help you sleep better. For some Ledger customers, the purchase has instead become the subject of a multimillion-dollar theft investigation.

Ledger said on October 9 that it was investigating reported fund losses among Southeast Asian users who bought devices through CryptoBilis. It asked the reseller to pause Ledger sales and shipments while the investigation continues, according to its statement reproduced by Decrypt.

In a later reply, Ledger said it believes the reported drains are limited to devices sold through CryptoBilis in Southeast Asia and has no indication that its own security infrastructure, systems or services were compromised. That is the company’s preliminary assessment. Ledger has not identified how the affected customers’ keys were exposed.

How much is missing?

The widely circulated $86 million-plus figure came from onchain investigator Specter. It was an estimate, rather than a confirmed total from Ledger, and reporting has cautioned that not every suspected theft has been conclusively linked to CryptoBilis.

An updated Bitquery investigation, using data through October 10 at 07:00 UTC, estimates $93.2 million drained from 315 wallets across six blockchains. Those are wallets, not necessarily 315 individual people. RLN has not independently reproduced the analysis, and Ledger has not confirmed that total.

What about the hidden chips?

Tibane Labs describes modified Ledger Nano X devices containing additional circuitry that intercepts screen data, reconstructs recovery words and transmits them through a cellular connection.

Crucially, the researchers say they have not examined a CryptoBilis-sold device or established a link between their specimens and these losses.

Ledger’s own security guidance acknowledges that its Genuine Check verifies the secure element but cannot detect unauthorized physical modifications when that chip remains intact. Passing an authenticity check therefore does not prove that nobody added hardware around it.

The ownership change

In a statement reproduced by Tibane Labs, former co-founders Arravind Prabu and Vimalatheethan say CryptoBilis was acquired earlier in 2026, with operational handover completed in March. They say they have had no system access since then.

They also say the acquisition agreement delayed a joint public announcement until mid-October, while suppliers had already been notified. RLN has not reviewed the agreement. A change of ownership does not establish wrongdoing or explain the thefts.

What buyers should know

CryptoBilis appears on Ledger’s official reseller directory. Customers using that directory had a reason to regard the seller as authorized.

Ledger’s October 9 advice covers people who purchased from CryptoBilis within the previous 90 days: do not begin setup if the device is unused; if already configured, consider moving assets to a new Ledger signer with a new recovery phrase. Contact official Ledger support for assistance.

The supported story is serious enough without declaring that every Ledger has been compromised. Reported losses, separate implant findings and the ownership disclosure deserve scrutiny. The missing piece is evidence establishing exactly how the affected customers’ keys were exposed.

Developing story. Figures and findings reflect sources checked October 10, 2026.

Sources and documents

Details can change. Review the linked sources and dated evidence alongside this report.

CryptoSecurityLedgerCryptoBilisHardware Wallets