Several users in Southeast Asia have reported unexplained asset outflows, with the available clues pointing to a single reseller channel. Ledger has asked the reseller to suspend sales, but neither the total losses nor the technical cause has been independently confirmed.

What Is Currently Known

According to an October 9, 2026 report by The Block, Ledger is investigating reports of asset losses involving some users in Southeast Asia. The affected users were reportedly linked to Ledger devices purchased through CryptoBilis, which was listed at the time as an authorized reseller serving Indonesia, Malaysia, and the Philippines. Ledger asked CryptoBilis to suspend sales and shipments and advised customers who bought a device through that channel within the previous 90 days not to complete the setup process for the time being.

For users who had already initialized their devices, Ledger's public guidance was to consider moving assets to a new signing device secured by a newly generated recovery phrase. This was a precautionary recommendation and does not mean that every device sold through the channel was confirmed to have been compromised.

Where Did the $86 Million Figure Come From?

The report cited tracking by two on-chain researchers. One estimate pointed to losses of more than $72 million, while another placed the combined suspicious flows across Bitcoin, Ethereum, and Tron at more than $86 million. The two estimates may include some of the same addresses or transactions and may also include activity that has not yet been confirmed as part of the same incident.

At the time of publication, neither the number of affected wallets nor the exact cause of the asset outflows had been confirmed by Ledger or an independent forensic investigator. It is therefore more accurate to treat the $86 million figure as an investigative lead rather than a settled loss total.

Where Could the Problem Have Occurred?

Public discussion has focused on potential supply-chain risk: whether devices were replaced or modified before reaching buyers, or whether users were manipulated into entering recovery phrases in an untrusted environment. Device authenticity, packaging integrity, and the initialization process have also been raised as areas requiring examination. These possibilities remain unverified and should not be used to claim that Ledger firmware or hardware contains a widespread vulnerability.

The central security boundary of a hardware wallet is the recovery phrase and the signing device. If a third party obtains the recovery phrase while it is being generated, backed up, or imported, that party can restore the wallet on another device. The assets could then be moved without the user initiating a transfer on the original device.

What Potentially Affected Users Can Do Now

  • Check the purchase channel and date, and retain the order record, packaging, serial information, and records of any suspicious transactions.
  • If the device falls within the channel and period identified by Ledger, follow the latest instructions published through Ledger's official support channels.
  • When moving assets, use a new device obtained from a trusted source and generate a completely new recovery phrase in an offline environment. Do not reuse the old phrase.
  • Treat any request for a 24-word recovery phrase, private key, or remote-control access as a serious risk. Official support staff will not ask you to send a complete recovery phrase.
  • Do not sign or transfer funds to social-media addresses offering “verification” or “compensation.” Enter the support section independently through the brand's official website.

Questions the Investigation Still Needs to Answer

The investigation needs to establish three points: whether affected devices came from the same batch or sales channel; whether the suspicious fund flows can be connected to specific purchase records; and whether the attack relied on physical tampering, recovery-phrase exposure, or another form of social engineering. Until reliable findings are available, users should avoid circulating unverified teardown photographs, descriptions of alleged attack devices, or victim counts.

This publication separates confirmed facts, media reporting, and researcher estimates. If Ledger, law-enforcement agencies, or independent forensic teams release new technical findings, both the characterization of the incident and the estimated loss may change.

Sources and Further Reading

Last edited: October 9, 2026. External pages and their contents may change. Refer to the original sources for the latest information.

<- Back to Security Guides Return to Homepage ->