French hardware wallet maker Ledger is investigating reported crypto thefts linked to Malaysian reseller CryptoBilis, with an independent researcher estimating suspected losses at over US$86 million.
According to The Block, on-chain investigator Specter estimated the losses after tracing funds sent to suspected theft addresses across Bitcoin, Ethereum and Tron.
Ledger has yet to confirm the amount stolen or the total number of affected customers.
The French company manufactures hardware wallets that store the private keys needed to access cryptocurrencies offline.
CryptoBilis, headquartered in Petaling Jaya, Selangor, is listed as an authorised Ledger reseller in Malaysia, Indonesia and the Philippines.
Ledger Orders CryptoBilis to Halt Sales Amid Investigation
On 9 October, Ledger announced through its official support account on X that it had asked CryptoBilis to suspend all sales and shipments of its devices as a precaution.
The company initially advised customers who had purchased devices from CryptoBilis within the previous 90 days not to activate them if they had not already done so.
Those who had set up their devices were advised to consider transferring their cryptocurrency to a new Ledger device using a newly generated recovery phrase.
In a subsequent update on X, Ledger confirmed that one affected customer’s device contained an unauthorised hardware implant. It has not established whether other devices were compromised in the same way.
In a later 72-hour update, Ledger stated that all confirmed cases linked to the 9 October thefts involved devices sold through CryptoBilis.
It maintained that the number of affected devices was limited and that its internal systems and direct sales channels remained unaffected.
Ledger also confirmed that CryptoBilis had stopped selling hardware wallets.
The company is working with authorities and contacting affected customers while reviewing its reseller controls and anti-tampering measures.
It has also reminded distributors to source products through approved channels and avoid reselling returned devices.
Under its latest guidance, Ledger advised CryptoBilis customers not to set up unused devices and urged those who had already activated their wallets to move their assets to a new device using a newly generated recovery phrase.
Affected customers were also advised to contact Ledger through its official support channels and file reports with local law enforcement.
72 hour update on reseller CryptoBilis incident 🔽
As the investigation continues, we are working with relevant authorities. The volume of impacted devices is limited. We know this is concerning, especially for those directly affected, and we are reaching out to impacted users.
To date, all confirmed cases related to the disclosed draining incident of Oct 9th, 2026, involve devices sold through the Southeast Asia reseller CryptoBilis. Our systems and direct sales channels remain unaffected.
We take the CryptoBilis situation seriously and are actively investigating.We encourage impacted users to reach out to Ledger Support through official channels and file complaints with their local law enforcement authorities. As a reminder, CryptoBilis has confirmed having ceased all sales of hardware wallets.
We are reminding our authorized resellers and distributors to source products only through authorized channels and never to restock returned products.
Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines.
Security isn’t static and this incident underscores why we continuously review and strengthen our distribution and anti-tamper processes.
We are continuously improving that work now and events like this strengthen our resolution: reviewing authorized reseller controls, advancing hardware protections, and cooperating with authorities. Thanks to @SEAL_911 for their collaborative support and all their efforts.
This is an ongoing threat that doesn’t just impact Ledger, but the whole ecosystem, and we are calling others in the space to work with us on making improvements for users.
We believe in jointly working with researchers, other vendors and partners on improving industry chain-of-custody practices and anti-tamper techniques. Raising the bar on physical supply-chain integrity benefits the entire ecosystem. If you have relevant information, contact security@ledger.com.
For CryptoBilis buyers: do not initialize unused devices. If already set up, move to a new seed on a device from Ledger. If you have concerns that your device was impacted by the CryptoBilis incident, please contact Ledger Support through the official site: https://t.co/JUcWwJO9iF.
Ledger Support is available 24/7 to answer your questions and concerns.
Scammers often try to take advantage of incidents like this. Rely only on official Ledger channels. Ledger will never call you, DM you, or ask for your 24-word recovery phrase.
— Ledger (@Ledger) October 11, 2026
CryptoBilis’ Former Founders Clarify Ownership Change
CryptoBilis’ former co-founders, Arravind Prabu and Vimalatheethan, clarified their involvement in the company in a statement shared on Facebook.
According to the former founders, CryptoBilis was acquired by new owners earlier in 2026. Both said they stepped down and completed the handover of operational responsibilities in March.
They maintained that they no longer had access to the company’s systems, customer records or daily operations, although they subsequently assisted with selected community events.
The former founders also stated that key suppliers, including Ledger and Trezor, had been informed of the ownership change.
They explained that contractual confidentiality obligations prevented a joint public announcement of the acquisition until mid-October 2026.
The statement identified Nicholas Chang as the current person responsible for CryptoBilis’ operations.
Hata and CoinGecko CEOs Raise Concerns Over Hardware Wallet Security
On 10 October, CoinGecko co-founder and CEO Bobby Ong warned in a post on X that purchasing hardware wallets from resellers carries additional supply chain risks, even when the retailers are authorised.
He recommended buying devices directly from manufacturers to reduce the risk of receiving compromised products.
Meanwhile, David Low, Co-Founder and CEO of Malaysian cryptocurrency exchange Hata, suggested bringing hardware wallet sellers under Malaysia’s digital asset custody regulatory framework.
In his X post, he also called for Ledger to clarify how it monitors its authorised reseller network and protects customers against device tampering.
It might be high time for cold wallet sellers to get regulated under Malaysia’s Digital Asset Custody law.
The reported Ledger wallet incident involving Malaysian reseller CryptoBilis is deeply concerning.
Hardware wallets are supposed to offer one of the highest levels of security for digital assets. If devices can be physically compromised before reaching customers, trust in the entire custody ecosystem is at stake.
Ledger must investigate transparently, clarify publicly how its authorised reseller network is monitored, and ensure all of its affected are protected.
This is a reminder that security is only as strong as the weakest link in the supply chain.
The crypto industry cannot afford to compromise on trust. And sadly, this has tarnished Malaysia’s web3 ecosystem
— David (Hata.io) (@hata_david) October 10, 2026
Featured image: Edited by Fintech News Malaysia, based on image by shyachlo via Magnific
