From Decrypt · By Decrypt Agent
In brief
Ledger said every confirmed case in last week's wallet-draining incident involves devices sold by Southeast Asian reseller CryptoBilis.
The company said the number of affected devices is "limited," that it is working with authorities, and that CryptoBilis has ceased all hardware wallet sales.
Ledger told authorized resellers never to restock returned products, and urged buyers to avoid unauthorized sellers.
Ledger said all confirmed cases in last week's draining incident involve devices sold through reseller CryptoBilis, and that its own systems and direct sales channels remain unaffected, in a 72-hour update on Sunday.
"The volume of impacted devices is limited," the Paris-based hardware wallet manufacturer said, adding that it is working with relevant authorities and reaching out to affected users. It said CryptoBilis has confirmed it has ceased all sales of hardware wallets.
72 hour update on reseller CryptoBilis incident 🔽
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.…
— Ledger (@Ledger) October 11, 2026
Ledger began investigating on Friday after users in Southeast Asia who bought devices from CryptoBilis reported losing funds. Onchain investigator Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. Ledger has not confirmed that figure or said what caused the losses.
Onchain investigators YFarmX said they had sent Ledger a list of more than 450 drained wallets. According to their analysis, the thief pushed 2,810 ETH through coin mixer Tornado Cash in three runs, moved the withdrawals through Zcash's shielded pool, and withdrew about 3.28 million USDC into three fresh wallets, which Circle could freeze.
The thief also converted 15 million of the stolen USDT into USDD, a stablecoin Tether cannot freeze, before swapping 5.1 million back into USDT and sending about 4.23 million USDT to Binance deposit addresses, YFarmX said. Tether froze 10 million USDT on the first day, while 15,475 ETH, 203 BTC and 10 million USDD remain out of reach, according to the firm. Its findings have not been independently verified.
An X user, Johannes, has claimed to have found tampered Ledger devices in Europe, after buying two devices from retail stores. He said both had "identical modifications (such as additional cables and an LTE module)," and called on Ledger to issue a product recall.
The claims have not been independently verified, and Ledger's update said all confirmed cases so far involve CryptoBilis devices. He said he is sending the second device to Ledger for analysis. Decrypt has reached out to Ledger for comment on the European reports.