Ledger said Sunday that its investigation into the CryptoBilis reseller incident is still open, three days after reports surfaced that wallets sold through the Southeast Asia-based reseller had been drained. The company confirmed it found an unauthorized hardware implant in at least one affected device, though it has not said whether other stolen wallets were tampered with the same way or disclosed how the implant worked.
72 hour update on reseller CryptoBilis incident 🔽
— Ledger (@Ledger) October 11, 2026
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.…
Blockchain analytics firm Bitquery traced $93.2 million linked to the exploit, taken mostly in USDT and TRON tokens from 315 wallets spread across six blockchains. The company has not responded to a request for confirmation of the estimate or whether it plans to offer reimbursement.
How the money moved and what got frozen
Tether froze $10 million in USDT connected to the theft, a step stablecoin issuers can take because they control token issuance at the smart contract level, unlike bitcoin or ether, which have no central party able to block a transfer once it's confirmed. Bitquery said roughly $81 million remained traceable onchain as of October 11, while some of the stolen funds had already passed through Tornado Cash and Zcash, two tools long associated with laundering stolen crypto because they obscure the link between sender and receiver.
Tornado Cash itself remains under a partial cloud. The US Treasury sanctioned the protocol in 2022, a decision a federal appeals court vacated in late 2024 on the grounds that immutable smart contracts cannot be designated property subject to sanctions, and Treasury formally removed the sanctions in early 2025. That makes it legal to interact with the protocol again, which may explain why it shows up here as a laundering route rather than a dead end.
Ledger draws a line CryptoBilis buyers are not accepting
Ledger has repeatedly framed the incident as isolated to CryptoBilis, stating that its own systems and direct sales channels remain unaffected. That framing has drawn pushback given that CryptoBilis was listed as an authorized reseller on Ledger's own website before the incident.
In its own update, Ledger said CryptoBilis has confirmed it ceased all hardware wallet sales, and the company reminded authorized resellers to source stock only through approved channels and never restock returned devices, a practice that would let a tampered unit re-enter the supply chain after being returned by a previous buyer.
This is not Ledger's first supply chain scare. In 2020, the company suffered a data breach that exposed the email addresses and physical mailing addresses of roughly 270,000 customers, which led to years of phishing attempts and even physical threats against known Ledger holders. The CryptoBilis case marks a shift from that episode, since this time the attack appears to target the hardware itself rather than customer data.
What this means for anyone who bought through CryptoBilis
Ledger's incident is also distinct from an April phishing campaign that used a fake Ledger Live app on Apple's App Store to drain at least $9.5 million after victims typed in their recovery phrases. In this case, the attacker appears to have obtained the keys needed to empty wallets directly, without needing the victim to hand anything over.
Ledger has told CryptoBilis customers not to set up any unused device still in its packaging. Anyone who already initialized a device bought through CryptoBilis should move funds to a new Ledger device with a freshly generated recovery phrase. The company said it is working with SEAL_911, a security collaboration group, and has asked anyone with relevant information to contact [email protected]. Ledger Support said it never calls, messages, or asks customers for their 24-word recovery phrase.
Jordan V.
Disclaimer: All materials on this site are for informational purposes only. None of the material should be interpreted as investment advice. Cryptocurrency investments involve significant risk of loss. Please note that, despite the nature of much of the material created and hosted on this website, HODL FM operates as a media and informational platform, not a provider of financial advisory services. The opinions of authors and other contributors are their own and should not be taken as financial advice. If you require advice, HODL FM strongly recommends contacting a qualified industry professional.
