Ledger, a well-known crypto hardware wallet, is investigating reports of cryptocurrency theft affecting its users in Southeast Asia. The affected users had purchased their hardware wallets through authorized reseller CryptoBilis. On-chain investigators have so far estimated the losses to more than $86 million.
In a statement, Ledger has said that it has asked CryptoBilis to suspend all Ledger device sales and shipments until the investigation continues. CryptoBilis operates in Indonesia, Malaysia, and the Philippines.
Ledger has advised its users who have purchased the devices from CryptoBilis in the last 90 days to not initialize unused wallets. Users who have already set up their devices are urged to transfer their assets to a new Ledger signer generated with a new seed phrase.
Ledger Support said it would continue updating customers as more information becomes available. However, Ledger has not yet confirmed the total losses and the number of affected customers.
Ledger Probes Possible Hardware Wallet Supply-Chain Attack
Specter, an independent on-chain investigator, has traced suspicious addresses that received funds from victims. These addresses are spread across various blockchains including Ethereum, TRON, and Bitcoin. The investigation has estimated the losses to be around $86 million. Other tracking firms including MistTrack and Arkham estimate that the losses exceed $90 million.
Changpeng Zhao, the founder of Binance, has commented that the attack appears to be a supply-chain attack involving a single vendor. He thinks that the affected customers may have purchased counterfeit or tampered devices.
There is currently no evidence presented in the announcement that Ledger’s core hardware, firmware, or infrastructure was directly compromised. The investigation remains focused on the reported incidents associated with the reseller.
Tether Freezes USDT as Investigators Track Stolen Funds
According to Onchain Lens, approximately 430.2 ETH, worth around $1.07 million, was deposited into Tornado Cash across four wallets. These ETH coins trace back to Ledger victims. Tether has freezed some coins. Following freezes by Tether, some USDT was reportedly converted into USDD. Addresses associated with the activity were still holding approximately $70.6 million in assets, including ETH, BTC, USDD, and USDT.
LEDGER HACKER MOVES FUNDS TO BINANCE, MIXES $1.07M ETH
The suspected hacker linked to the reported $90M Ledger reseller incident has deposited 430.2 ETH ($1.07M) into Tornado Cash across 4 wallets.
Following Tether’s fund freezes, the hacker has been converting USDT into USDD through https://t.co/pMx32wOBCv and USDD’s PSM. Some funds have also reached a Binance hot wallet.
Binance hot wallet: TDqSquXBgUCLYvYC4XZgrprLK589dkhSCf
Arkham-tracked hacker wallets currently hold $70.60M:
· 11.406K ETH ($28.35M)
· 213.371 BTC ($17.65M)
· 13.646M USDD ($13.65M)
· 10.909M USDT ($10.91M)Tagging @binance to investigate these transfers and freeze any accounts linked to the stolen funds as soon as possible.
Onchain activity is still unfolding. We will continue tracking the funds and sharing updates.
— Onchain Lens (@OnchainLens) October 9, 2026
The movement of funds across multiple blockchains and services may complicate efforts to identify the individuals responsible and recover the assets. Meanwhile, Ledger’s investigation is ongoing and the company is yet to confirm the full scale.