Up to $93 million drained from wallets tied to devices sold by one reseller. What is confirmed, what is not, and how to protect yourself.
Around 9 October 2026, large-scale withdrawals were reported from wallets tied to Ledger devices sold by CryptoBilis, a reseller listed as authorised on the manufacturer's website. On 12 October CoinDesk summarised what was known. The figures below are estimates by analytics firms, not a total confirmed by Ledger.
The known facts
According to CoinDesk, the analytics firm Bitquery traced $93.2 million taken from 315 wallets across six blockchains, mostly in USDT and TRON tokens. Another platform, YFarmX, estimated $94.5 million from 521 addresses across seven blockchains. Both estimates rely on public blockchain data. Ledger has not confirmed the total and has not said whether it plans a reimbursement scheme. Tether froze $10 million in USDT linked to the theft. According to Bitquery, about $81 million could still be traced on-chain as of 11 October, while part of the funds had moved through Tornado Cash and Zcash.
What Ledger has confirmed
Ledger stated that every confirmed case involves devices sold by this Southeast Asian reseller, and confirmed an unauthorised hardware implant in at least one device. It did not say whether the stolen wallet was compromised in the same way, or how the devices were tampered with. It advises affected customers not to set up unused devices and, for those already using one, to move funds to a new device with a new recovery phrase. Part of the community disputes the claim that this is an isolated case, because the reseller was listed among the authorised ones.
Different from phishing
CoinDesk distinguishes this episode from an April phishing campaign with a fake Ledger Live app, which reportedly drained at least $9.5 million from users who entered their recovery phrase. This time, according to the article, the attacker appears to have obtained the keys needed to empty hundreds of wallets directly. The risk therefore does not lie in a user mistake, but in the device's supply chain.
What it means for crypto users
The case does not show that hardware wallets are insecure in general, and it should not be read that way. It shows that trust in a device also depends on how it is bought. A few common-sense practices, in general use and not taken from the source:
- buy only from the manufacturer or from channels you can verify directly on its website;
- never use a recovery phrase that is pre-printed or supplied in the box;
- generate the recovery phrase yourself and keep it offline;
- be wary of unusually low prices and of devices with opened packaging.
For companies that hold digital assets, the case confirms the value of controlled purchasing procedures, multiple signers for important movements and an inventory of devices.
One last point: the article notes that stablecoin issuers can freeze tokens linked to a crime, unlike bitcoin and ether. It is a technical difference worth being aware of, without drawing conclusions about the merits of either choice.
Sources
- CoinDesk, Ledger claims CryptoBilis cases are limited as up to $93 million is traced, $10 million frozen, 12 October 2026: https://www.coindesk.com/tech/2026/10/12/ledger-claims-cryptobilis-cases-are-limited-as-up-to-usd93m-is-traced-usd10m-frozen
Information, not advice. Figures are third-party estimates reported by the source.
