Ledger Investigates Suspected $86M Drain Tied to Reseller's Tampered Devices

Ledger, the Paris-based hardware wallet maker, said Friday it is investigating reports that customers in Southeast Asia lost funds after buying devices from a third-party reseller called CryptoBilis, according to Decrypt. The company has told some users to hold off on setting up their wallets while it looks into what happened.

The core of the problem, per Decrypt, is a hardware implant: a cellular (LTE) component found in affected devices that captured users' recovery phrases — the secret backup that grants full control of a wallet's funds. If seed phrases were exfiltrated off-device, the hardware wallet's central security promise (that the secret never leaves the device) would be defeated at the point of sale, before the customer ever used it.

Ledger said it has moved to contain distribution. "As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices," the company's support account wrote, as quoted by Decrypt.

On the size of the loss, the figure is not settled even within the single account available. Decrypt's headline puts the suspected drain at $86 million; its subheadline says Ledger is probing a potential theft of $87 million. Both numbers are described as "suspected" or "potential" — not confirmed totals. No independent on-chain accounting or primary statement from Ledger quantifying the loss has been presented here, and the mechanics beyond the LTE implant description have not been detailed.

Key facts

• Ledger is investigating lost customer funds tied to devices sold by reseller CryptoBilis in Southeast Asia (Decrypt, Oct 13).
• An LTE implant in affected devices captured users' recovery phrases (Decrypt).
• Suspected loss: $86M (Decrypt headline) / $87M (Decrypt subheadline) — figure unconfirmed.
• Ledger asked CryptoBilis to pause all sales and shipments, and told some users to delay wallet setup (Ledger support account, via Decrypt).

The real-world read

Treat the dollar figure as provisional: a single secondary outlet reports two different totals ($86M vs $87M) a line apart, and both are flagged "suspected." Until Ledger or on-chain analysts publish a count, no precise number should be repeated as fact. The attack vector described is a supply-chain compromise — tampering that happens before the buyer touches the device — which is why "buy only from the official channel" is the standing advice for hardware wallets; a reseller sits exactly where that advice is meant to protect you. Ledger pausing a reseller's shipments is a containment step, not a finding: it has not said how many devices were affected, how the implant was installed, or whether CryptoBilis was complicit or itself compromised. Those gaps are the story's open questions, and the sourcing here is thin — one reputable secondary report, no primary Ledger advisory or on-chain data in hand. (Note: Decrypt's page also carries an embedded "Myriad" prediction-market promo — ad content, unrelated to the reporting.)

This is news, not financial advice.

Sources

• Decrypt (secondary, reputable), "Ledger Finds LTE Implant That Stole Recovery Phrases in Suspected $86M Drain," Oct 13, 2026 — sole source for the investigation, the CryptoBilis reseller link, the LTE-implant description, the loss range, and the quoted Ledger support statement. The page carries an embedded Myriad prediction-market ad, which is promotional and not part of the reporting.