Ledger customers are confronting a hardware-wallet theft investigation after an unauthorized implant was found inside one affected device and researchers traced tens of millions of dollars in stolen crypto. The latest company update, published October 11, links every confirmed draining case to devices sold through Southeast Asian reseller CryptoBilis.
That finding leaves two urgent questions: how the attackers obtained control of customers’ wallets, and whether further tampered devices exist outside that sales channel. A European buyer has separately reported suspicious hardware, but that allegation has not been confirmed as part of the draining incident.
What happened to the Ledger wallets?
Customers began reporting missing funds on October 9. The transfers crossed multiple blockchains, despite owners having bought hardware wallets specifically to keep their signing keys away from internet-connected computers. The affected reseller operates in Malaysia, Indonesia and the Philippines.
On October 10, Ledger confirmed that one impacted customer’s device contained an unauthorized hardware implant. That establishes physical tampering in at least one case. It does not establish that every affected device contained the same implant, or explain exactly how the attackers captured the credentials used in the theft.
The company’s October 11 update drew a distinction between the confirmed reseller-linked losses and its own infrastructure:
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.
CryptoBilis subsequently suspended sales and shipments of all hardware-wallet brands across its stores and online channels. Its October 10 management notice described the broader shutdown as precautionary:
We are doing this as a precaution to protect our customers while Ledger's investigation continues and while we review our own processes with the help of independent specialists.
The retailer also said its physical stores were temporarily closed. Its suspension of other brands does not establish that those manufacturers’ devices were compromised.
How much was stolen, and who lost money?
Bitquery’s updated on-chain investigation, verified October 11, estimates $93.2 million taken from 315 wallets across six blockchains. Earlier circulating totals were lower. This is an independent tracing estimate, rather than a final loss figure confirmed by the manufacturer or law enforcement.
The largest losses were on TRON, followed by Bitcoin. The researchers counted money leaving victim wallets, excluding later swaps and transfers between the attacker’s own addresses to avoid counting the same funds repeatedly.
Wallets are not people. One owner can hold several wallets, and some addresses were affected across multiple compatible blockchains. Adding each network’s wallet count would therefore overstate the number of distinct wallets, let alone individual victims.
The investigators found synchronized approvals and transfers, alongside smaller test transactions before the main drain. Their assessment is that the attacker already controlled the necessary keys. Blockchain records can establish what moved and where; they cannot, by themselves, establish where those keys were exposed.
As previously reported by Apex, Ethereum transactions rely on cryptographic authorization. A hardware wallet cannot protect funds if an attacker independently obtains the recovery phrase or equivalent signing secrets. Changing a device’s PIN does not repair that exposure.
Are buyers outside Southeast Asia affected?
The latest confirmed draining cases remain tied to CryptoBilis. On October 11, an X user posting as 0xJohannes_ separately claimed to have bought a device from a European retailer and found extra wiring inside it. The user said that device had not transferred funds to the attacker.
That report warrants investigation, but it does not establish a confirmed European extension of the same theft. There is also no basis for treating every Ledger owner as an identified victim, or concluding that the cryptography protecting the blockchains has been broken.
Buyers should distinguish this investigation from a separate, older phishing campaign. Zscaler ThreatLabz documented an August campaign in a September 25 report: malicious Google advertisements led users through hosted pages to a fake verification process that requested their recovery words. It has not been established as the cause of the CryptoBilis losses.
What should affected customers do next?
The current advice for CryptoBilis buyers is to leave unused devices uninitialized. Customers who have already set them up should move remaining assets to a device obtained directly from Ledger, using a newly generated recovery phrase. Restoring the old phrase on new hardware would preserve any existing compromise.
CryptoBilis asks victims to retain the device and packaging, avoid resetting them, and preserve order details, serial numbers, wallet addresses and transaction IDs. Those records can support the investigation and a police complaint. Support should be reached through official channels, rather than unsolicited messages offering recovery services.
There is progress in tracing the money, but tracing is not reimbursement. The on-chain report identifies $10 million in USDT frozen by Tether and a further $5.35 million in USDC that Circle could freeze. The latter is an identified opportunity for intervention, not confirmation that a freeze has occurred. Neither figure establishes that victims have received their funds back.
The next milestones are a verified explanation of the hardware tampering, a clearer inventory of affected devices and action on recoverable funds. Distribution controls also matter: the manufacturer is reminding resellers not to restock returned products. Until investigators settle the scope, customers should follow the specific purchase-channel warning and never give recovery words to a website, caller or supposed support agent.