Ledger Says Don't Turn On the Box It Sold, $86M Gone on Bitcoin, Ethereum and Tron
Specter puts the damage above $86 million across Bitcoin, Ethereum and Tron. Ledger cannot yet say what the devices had to do with it.
Ledger is investigating thefts reported by Southeast Asian users who bought devices through the reseller CryptoBilis[1]. On Oct. 9, 2026, on-chain investigator Specter estimated losses above $86 million across hundreds of wallets on Bitcoin, Ethereum and Tron[2][3].
Ledger asked CryptoBilis to halt sales and shipments, and told buyers from the past 90 days not to initialize their devices[4][5]. The attack method, victim count and any device link are unconfirmed[6]. One Bitcoin address flagged in Specter’s analysis received more than 211 bitcoin and had not moved it then[7].
What to do: do not initialize a device bought from CryptoBilis in the past 90 days[4]. If setup is already finished, create a new signing device with a new mnemonic phrase and move the assets[4].
Who gains, who loses
Receipts
Ledger is investigating reported asset theft involving Southeast Asian users who purchased devices through reseller CryptoBilis.
“Odaily reports that Ledger Support posted on X platform stating that it is currently investigating a theft of assets involving Southeast Asian users, who had purchased devices through reseller CryptoBilis.”
On-chain investigator Specter estimated that hundreds of wallets on Bitcoin, Ethereum, and Tron were affected, with losses exceeding $86 million.
“On-chain investigator Specter previously estimated that this incident has led to the theft of hundreds of wallets across Bitcoin, Ethereum, and Tron networks, with losses exceeding $86 million.”
The suspected drain was identified on October 9, 2026, and multiple addresses allegedly received funds from hundreds of victim wallets.
“The suspected drain was identified on Oct. 9. Specter linked the activity to multiple addresses that allegedly received funds from hundreds of victim wallets.”
Ledger asked CryptoBilis to suspend device sales and shipments during the investigation.
“Ledger has asked CryptoBilis to suspend sales and shipments, and recommends that users who purchased devices through this reseller within the past 90 days refrain from initializing their devices; users who have already completed setup…”
Ledger’s warning concerned CryptoBilis buyers who acquired devices during the previous 90 days.
“The request concerns CryptoBilis sales and buyers who acquired devices during the past 90 days.”
The attack method, victim count, and connection to Ledger devices remained unconfirmed in the available information.
“The attack method, victim count and connection to Ledger devices remain unconfirmed.”
A Bitcoin address identified in Specter’s analysis received more than 211 BTC, and the funds had not moved when the analysis was conducted.
“A Bitcoin address flagged in the analysis, bc1qjqgwejnp8dc0x2938x9n9954hj97t82unx49dl, received more than 211 Bitcoin (BTC). The funds had not moved at the time of the analysis.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.