Ledger names Southeast Asia reseller in $86M wallet drain

Customers in Southeast Asia who bought Ledger wallets from the reseller CryptoBilis have reportedly lost more than $80 million to an ongoing draining campaign.

Researchers Specter and Tanuki42 were the first to notice accounts of Ledger users losing assets. Following the addresses, they arrived at loss figures ranging from $72 million to more than $86 million.

Ledger then confirmed that it is looking into a specific problem related to CryptoBilis, which has been ordered “to pause all sales and shipments of Ledger devices.”

Those who purchased a device from CryptoBilis during the preceding 90 days have additionally been cautioned against starting the setup process, and if they already have, to shift their holdings to a different Ledger signer.

There have been a reports on X and Reddit of wallet-draining by Ledger users.

I traced the theft addresses and identified inflows from more hundreds of victim wallets across several major blockchains, including Ethereum, TRON, and Bitcoin.

Total losses $86M+… pic.twitter.com/c5dhQeAZ0l

— Specter (@SpecterAnalyst) October 9, 2026

Ledger added, “We will continue to inform customers of updates as the investigation progresses.”

CryptoBilis is a hardware wallet retailer that styles itself as a “trusted Web3 brand in Southeast Asia,” carrying Ledger, Trezor, OneKey, Tangem, SafePal and other devices.

It also designates itself as “the authorized reseller of Ledger products in Malaysia.”

Mark Karpelès, who once led Mt Gox, noted yesterday that some resold Ledger wallets were discovered to have been altered and fitted with spyware intended to harvest passkeys.

In response to a comment request, Ledger pointed Protos to its earlier X post and said, “We have nothing further to add at this time.”

Ledger reports are causing a panic

Security researcher Taylor Monahan has warned several accounts spreading stories about Ledger wallet drains that they are creating panic and making users believe in a zero-day vulnerability when none seems to exist.

She flagged the perils of phishing, counterfeit Google advertisements, and fake apps that could empty the wallet of someone urgently moving their assets out of fear.

Justin Drake, an Ethereum researcher, recently urged cryptocurrency holders to enter “bunker mode” and place their funds in a secure location to guard against AI potentially breaking elliptic curve cryptography in “months.”

Monahan also suggested Drake’s message might cause “more harm than what it’s warning against,” then turned to the danger of malicious links appearing in Google search results.