Ledger tells CryptoBilis buyers to stop using tampered wallets after $86 million to $93 million drain

Ledger has a blunt message for anyone who bought a hardware wallet from CryptoBilis recently: do not trust that device. If it is still in the box, leave it uninitialized. If you already set it up, move your assets to a new Ledger with a brand-new recovery phrase.

The guidance follows on-chain investigations that estimate losses ranging from $86 million to $93 million, spread across hundreds of wallets.

What Ledger found inside the box

On October 9, 2026, Ledger ordered CryptoBilis, its Southeast Asian reseller, to stop all sales and shipments. The move came after reports that wallets bought through the distributor were being drained.

A day later, on October 10, Ledger confirmed that at least one affected device contained an unauthorized hardware implant. According to the company, every verified draining case traced back to a CryptoBilis purchase.

The implant was an LTE-enabled microcontroller with eSIM functionality. It could capture a user’s recovery phrase during wallet setup, without compromising the device’s secure element.

The affected wallets spanned multiple networks, including Bitcoin, Ethereum, and TRON.

The reseller problem

CryptoBilis operates in Indonesia, Malaysia, and the Philippines. It has suspended all sales activity while the investigation continues.

The timing adds another wrinkle, since the incident follows an ownership change earlier in March 2026. Ledger has said it is reviewing its reseller protocols and anti-tampering measures in response.

The company also stressed that its direct sales channels and infrastructure were not affected. Ledger says it is working with authorities and received help from SEAL 911, a security group that assists with crypto incident response.

The 90-day window in Ledger’s guidance is the practical takeaway. Customers who bought from CryptoBilis in that period are the ones being told to start fresh. For people who already set up their device, that means a new wallet and a new recovery phrase, not just a new PIN or a firmware update.

Why this matters beyond one distributor

The investigation is still developing on several fronts. Key open questions include how many devices carried implants, how the tampering got into the distribution chain, and whether authorities identify those responsible. The final loss figure may also shift as on-chain tracking continues.

For anyone holding a CryptoBilis-sourced Ledger bought in the past 90 days, the to-do list is short and not optional. Do not initialize unused devices, get a new wallet, generate a new phrase, and move the funds.