Analysis
The case turns on trust in the supply chain: a device sold through an authorized channel is only as safe as the hands it passes through before the buyer sets it up. A confirmed implant in one device explains one loss, not necessarily all of them, and the size of the total depends on how outside analysts count wallets, chains and prices.
What happened
On Friday, October 9, Ledger, the Paris-based maker of hardware wallets, said it was investigating reports that customers who bought its devices from a Southeast Asian reseller, CryptoBilis, had lost cryptocurrency. A hardware wallet is a small device that holds the secret keys that control a person’s crypto; whoever has the keys can move the funds. Ledger asked CryptoBilis to pause sales and shipments, told people who had bought a device from it in the previous 90 days not to set it up, and advised those who had already used one to move their assets to a new device with a newly generated recovery phrase. [4]
A pseudonymous blockchain investigator known as Specter had first put the losses above $86 million after tracing suspected thief addresses across Bitcoin, Ethereum and Tron, CoinDesk reported. At that point neither the losses nor the connection to the reseller had been independently verified. [4]
By Monday, October 12, the picture had firmed up in some respects and not in others. Ledger’s statements, as reported by CoinDesk, now tie every confirmed case to CryptoBilis devices, but the company has not published a loss total, and the larger figures in circulation come from outside analysts. [1][3]
What Ledger has said
On October 10, Ledger’s support account said: “Ledger can confirm that one of the impacted users’ devices contained an unauthorized hardware implant.” CoinDesk reported that an October 11 update from Ledger said all confirmed cases connected to the October 9 draining incident involve devices sold by CryptoBilis, a reseller operating in Indonesia, Malaysia and the Philippines. [3]
Ledger also said its internal systems and direct sales channels were not compromised, and that it is reviewing controls on its authorized resellers. CryptoBilis has suspended sales of all hardware-wallet inventory until the investigation concludes, according to CoinDesk, which said CryptoBilis did not respond to requests for comment. [3]
These are company statements. As CoinDesk reported on October 12, Ledger has not said how the device was tampered with, or whether the other stolen wallets were compromised in the same way. It had also not confirmed a loss figure or a reimbursement plan. [1] Critics have noted that CryptoBilis was listed as an authorized reseller on Ledger’s website; one X user wrote, “It’s not a CryptoBilis incident, it’s a Ledger incident.” [1] Ledger’s statements here are as quoted by CoinDesk. Ledger also said it is cooperating with authorities. [3]
How analysts estimate the losses
Blockchain-data company Bitquery traced $93.2 million taken from 315 victim wallets on six blockchains, most of it in the Tether USDT on the Tron network. Bitquery’s figures are its own estimates from public blockchain data. [2]
A second analytics firm, YFarmX, put the total at about $94.5 million from 521 addresses on October 11, then at about $103.4 million from 530 addresses on seven blockchains in an October 12 update. These are outside estimates, not confirmed losses, and a wallet is not necessarily a separate victim: one person may own several, and some were drained on more than one chain. [2][5]
Bitquery’s breakdown by blockchain is below. Because some wallets were hit on more than one chain, the per-chain wallet counts add to more than 315. [2]
The freeze and the trail
Tether froze about $10 million of USDT linked to the theft, CoinDesk reported; Bitquery confirmed the freeze, describing $10.0 million held in 20 wallets, and YFarmX put it at 10,000,001 USDT. Tether did not respond to CoinDesk’s request for comment at the time. [1][2][5]
A freeze stops the tokens from moving; Tether can later reissue frozen coins, Bitquery noted. Bitquery also reported that the thief parked about $15 million in USDD, a token Tether cannot freeze, before swapping it into ether, and ran 2,990 ether through the Tornado Cash mixing service and then Zcash. Bitquery rated its tracing of those mixer movements as strong, an analyst assessment rather than a finding by investigators. [2]
CoinDesk reported, citing Bitquery, that about $81 million could still be traced on the blockchains as of October 11; Bitquery’s latest update puts that figure at about $86 million. The Bitcoin had not moved, Bitquery said. [1][2]
What remains unclear
The central gaps are how the implant reached the device, how many devices were affected, whether every drained wallet had one, and who is responsible. Bitquery notes that the blockchain records cannot show how the other keys leaked, and Ledger has confirmed an implant in one victim’s device only. [2][5]
The identity of CryptoBilis also comes mostly from second-hand descriptions. CryptoBilis’s own website lists it as “a brand of CB International,” and YFarmX reported that Ledger’s reseller finder listed it for Malaysia, Indonesia and the Philippines as of October 9, with some entries later marked as paused or removed. [5] No finding that CryptoBilis itself was responsible has been reported.
What remains uncertain
Loss totals are third-party estimates that differ by method, and Ledger has not confirmed any total. Ledger’s statements are company claims as reported by CoinDesk; an implant is confirmed in one device only, and the cause of other losses is unproven. Links between mixer activity and the thief are analysts’ assessments, not findings by investigators or a court, and no responsible party has been publicly identified.
Sources
- CoinDesk — Ledger claims CryptoBilis cases are limited as up to $93M is traced, $10M frozen, October 12, 2026 ↗Source
- Bitquery — Ledger CryptoBilis hack investigation, published October 10 and updated October 11, 2026 ↗Source
- CoinDesk — Ledger says unauthorized implant found in at least one device sold by CryptoBilis, October 12, 2026 ↗Source
- CoinDesk — Ledger investigates potential wallet tampering after reports of $86 million in crypto stolen, October 9, 2026 ↗Source
- YFarmX — Ledger reseller CryptoBilis drain analysis, updated October 12, 2026 ↗Source