Ledger Pins Confirmed Wallet Drains on Reseller CryptoBilis as On-Chain Sleuths Trace $86M+

Ledger says every confirmed case in last week's wallet-draining incident involves hardware wallets bought through a single Southeast Asian reseller, CryptoBilis — and that its own systems and direct sales channels are unaffected. The Paris-based manufacturer posted the detail in a 72-hour update on its X account on October 11, after opening an investigation on Friday when users who bought devices from CryptoBilis reported losing funds.

Ledger called the number of affected devices "limited," said it is working with authorities and contacting affected users, and said CryptoBilis has confirmed it has stopped selling hardware wallets. The company has not confirmed a dollar figure or stated what caused the losses. It told authorized resellers to source only through official channels and "never to restock returned products," and repeated that it will "never call you, DM you, or ask for your 24-word recovery phrase."

The dollar figures come from on-chain investigators, not Ledger. Decrypt reported that analyst Specter traced more than $86 million in suspected thefts across Ethereum, Tron and Bitcoin. A second firm, YFarmX, said it handed Ledger a list of more than 450 drained wallets and detailed a laundering trail: 2,810 ETH pushed through Tornado Cash in three runs, routed via Zcash's shielded pool, with roughly 3.28 million USDC withdrawn into three fresh wallets that Circle could freeze. YFarmX also said the thief converted 15 million USDT into Tether-unfreezable USDD, swapped 5.1 million back to USDT, and sent about 4.23 million USDT to Binance deposit addresses. Per YFarmX, Tether froze 10 million USDT on day one, while 15,475 ETH, 203 BTC and 10 million USDD remain out of reach. Those findings have not been independently verified.

Key facts

• All confirmed cases involve CryptoBilis-sold devices; Ledger systems unaffected — Ledger X update, Oct 11, 2026.
• CryptoBilis has ceased all hardware wallet sales — Ledger.
• More than $86M in suspected thefts across ETH, Tron and BTC — Specter, via Decrypt.
• 450+ drained wallets; laundering via Tornado Cash, Zcash, USDD; 10M USDT frozen by Tether — YFarmX (unverified).

The real-world read Two things to hold apart. First, the "$87M" in the headlines is an investigator's estimate, not a confirmed loss — Ledger pointedly has not endorsed any figure and won't yet say what went wrong. Treat the number as a range and a work-in-progress. Second, Ledger's "all confirmed cases are CryptoBilis" framing is narrower than it sounds: an X user, Johannes, claims he bought two tampered Ledgers from retail stores in Europe — with added cables and an LTE module — and is sending one to Ledger for analysis. That is unverified, and Ledger says its confirmed cases remain reseller-linked. But "confirmed so far" is not the same as "contained," and a supply-chain tampering story that spreads beyond one reseller would be a different, larger problem. Worth watching whether Ledger's device count and geography stay put.

Opinion, and whose Ledger frames the incident as isolated to an unauthorized reseller and its own hardware as sound — an interested party's characterization while its investigation is open. Johannes called for a product recall; that is his view, based on unverified devices.

Not financial advice.