Skip to content

Back to the catalog

Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis
decrypt.coarticle

Ledger Says All Confirmed Cases in Suspected $87M Drain Tied to Reseller CryptoBilis

Decrypt reports Ledger's 72-hour update: all confirmed wallet-draining cases involve devices sold by Southeast Asian reseller CryptoBilis, which has stopped hardware wallet sales. Onchain investigators Specter and YFarmX traced over $86M in suspected thefts across Ethereum, Tron and Bitcoin. They describe laundering through Tornado Cash, Zcash's shielded pool and a USDT-to-USDD swap to avoid Tether freezes. An unverified claim of tampered devices (extra cables, LTE module) bought at European retail stores is also covered. Ledger advises CryptoBilis buyers not to set up devices and to move funds to a new seed phrase on a device bought from Ledger.

TL;DR Ledger says all confirmed drains in the suspected $87M incident trace to reseller CryptoBilis devices; investigators detail the laundering path.
Open original ↗
Document

What it is

Ledger's 72-hour update on a wallet-draining incident (Ledger's post is dated October 11, 2026). Every confirmed case involves devices sold by the Southeast Asian reseller CryptoBilis. Ledger says its own systems and direct sales channels are unaffected and that the number of affected devices is "limited". It has not confirmed the loss figure or said what caused the losses.

Preconditions / Affected

  • The device was bought from CryptoBilis, which says it has stopped all hardware wallet sales.
  • Ledger told authorized resellers to source only through authorized channels and "never to restock returned products". It warned that unauthorized resellers carry a real risk of "suspicious, counterfeit or modified devices".
  • A separate X user, Johannes, says two devices he bought from European retail stores had "identical modifications (such as additional cables and an LTE module)". He is sending one to Ledger. This is unverified, and Ledger says all confirmed cases are CryptoBilis.

What to do

  • If you have an unused CryptoBilis device, don't set it up.
  • If you already set one up, move funds to a new seed phrase on a device bought directly from Ledger.
  • Expect scams. Ledger says it "will never call you, DM you, or ask for your 24-word recovery phrase."
  • If you hold devices from non-Ledger retail channels, the European tampering claim is unconfirmed. Ledger has not said whether it applies to them, so the safe course is to treat the source as the risk and buy directly.

Laundering trail (per YFarmX, unverified)

  • YFarmX sent Ledger a list of more than 450 drained wallets.
  • 2,810 ETH went through Tornado Cash in three runs, then through Zcash's shielded pool.
  • About 3.28M USDC went into three fresh wallets, which Circle could freeze.
  • 15M stolen USDT was converted to USDD, which Tether can't freeze. 5.1M was swapped back, and about 4.23M USDT went to Binance deposit addresses.
  • Tether froze 10M USDT on day one. Still out of reach: 15,475 ETH, 203 BTC and 10M USDD.

Caveats

  • The $86M+ figure comes from investigator Specter, and the laundering details from YFarmX. Ledger has confirmed neither, and the page says none of it is independently verified.
  • The root cause is unstated. The page does not say whether the devices were tampered with, pre-seeded, or something else.
  • Decrypt had asked Ledger about the European reports and had no answer yet.

Technologies named here

Threat actors named here

Related in Blockchain