Ledger Probes CryptoBilis Wallet Theft Reports

Published: 2026-10-09 20:39:06 |

Ledger is investigating reports of crypto theft involving customers who bought hardware wallets from Southeast Asian reseller CryptoBilis. Ledger asked the reseller to pause sales and shipments, warned customers who bought a device in the past 90 days not to set it up, and advised those who already activated one to move funds to a new Ledger signer with a fresh recovery phrase. Ledger says there is no evidence its hardware or infrastructure was directly compromised, and it has not confirmed the number of victims or total losses. Onchain investigator Specter traced more than $86 million in funds to suspicious addresses across Bitcoin, Ethereum and TRON, including about $42 million in ETH, $17.6 million in BTC and $16.5 million in USDT. These figures are not a verified measure of customer losses, and investigators have not confirmed that all cases are connected. Binance founder Changpeng Zhao said the incident appeared localized and could involve a supply-chain attack by one reseller. Investigators have not established whether devices were altered or supplied with compromised recovery phrases. The case highlights hardware-wallet supply-chain risks, but there is no current evidence of a wider Ledger breach or attack on the Bitcoin, Ethereum or TRON networks.

Neutral

The reports describe a possible reseller-level supply-chain issue, not a confirmed vulnerability or breach in Bitcoin, Ethereum or TRON. That distinction limits the direct price implications for BTC, ETH and TRX. The incident may still prompt short-term risk aversion, security concerns and selling by some holders, particularly if further losses or compromised devices are confirmed. However, the reported $86 million represents funds at suspicious addresses, not a verified total of victims’ losses, and investigators have not linked every case. In the longer term, the event could reinforce demand for secure custody practices and closer scrutiny of hardware-wallet distribution, but it does not currently indicate a change in the underlying networks’ fundamentals. Market impact is therefore expected to remain limited unless evidence emerges of broader exposure or sustained selling.