Ledger Investigates Possible $86 Million Crypto Theft Linked to Reseller Devices

Ledger opens investigation into alleged $86 million theft

Ledger, a company that makes hardware wallets, said on Friday it is looking into reports that more than $86 million in cryptocurrency may have been stolen from wallets connected to devices sold by a reseller called CryptoBilis in Southeast Asia. The company acknowledged the reports in a post on its official X account but did not confirm the total amount lost or explain what caused the thefts.

A hardware wallet is a physical device that stores the private keys — secret codes used to access cryptocurrency — offline, away from internet-connected computers. Ledger, founded in Paris in 2014, says it has sold over 7 million of these devices worldwide.

Key numbers and details

• Pseudonymous blockchain investigator Specter reported on X that more than $86 million in crypto may have been stolen from hundreds of wallets.
• The stolen assets were traced across Bitcoin, Ethereum, and Tron addresses.
• The reported losses have not been independently verified by anyone outside the initial report.
• Ledger asked CryptoBilis to stop all sales and shipments while the investigation continues.
• Customers who bought devices from CryptoBilis in the last 90 days were told not to set them up.

What Ledger publicly said

In its X post, Ledger confirmed it was investigating the situation but stopped short of confirming the $86 million figure or naming a cause. The company instructed CryptoBilis to halt all sales and shipments immediately. For buyers who purchased devices from the reseller within the past 90 days, Ledger advised against setting them up at all. Those who had already activated their wallets were told to consider transferring their crypto to a brand-new Ledger device with a freshly generated recovery phrase — the set of backup words that lets a person restore access to a wallet on a new device.

What is confirmed and what is still unknown

Confirmed: Ledger is investigating the reported thefts. CryptoBilis has been asked to pause sales and shipments. Ledger has issued guidance to affected customers.

Still unclear: The total amount stolen is not independently verified. The number of affected users is unknown. The cause of the thefts has not been identified. It is not yet clear whether the incidents are connected or if they stem from tampered devices, as some social media posts suggested. A supply-chain attack — where devices are altered before they reach buyers — was mentioned as one possible explanation, but no source has confirmed that theory.

Why this matters for hardware wallet users

Many crypto investors rely on hardware wallets instead of leaving their assets on exchanges, which hold large pools of digital assets and can be targets for hackers. If the investigation finds that devices sold through a reseller were tampered with before reaching customers, it could raise questions about how widely such practices may exist and whether other resellers are involved.

2026 has already seen several major crypto thefts. In September, exchange Bitget reported losing over $350 million in an exploit. Other notable incidents this year included roughly $320 million from Liquid Network, $295 million from Drift, and $293 million from Kelp, according to DefiLlama data.

Sources

• CoinDesk