The cold wallet manufacturer Ledger has confirmed that all verified cases in the recent incident that resulted in the theft of approximately $87 million are directly linked to devices distributed by the Southeast Asian reseller CryptoBilis. The company clarified that its core systems and direct sales channels were not compromised.
Preliminary research points to a gap in the external physical distribution chain, highlighting the critical risks that arise when acquiring custody solutions outside of direct and authorized official channels.
The official investigation and its scope in the supply chain
Following alerts issued by affected users in early October 2026, the Paris-based technology company published a comprehensive update. In this technical report, Ledger stated that all confirmed cases in the alleged $87 million drain involved devices sold by CryptoBilisAccording to the company, the total volume of compromised devices is limited and confined to this regional distributor, which has immediately ceased all its hardware wallet business operations.
The manufacturer emphasized that its operational infrastructure, validation software, and direct sales platform continue to operate normally. However, the investigation is being conducted in close collaboration with relevant law enforcement agencies to determine at what point in the physical chain of custody the devices were tampered with. Ledger has begun proactively contacting registered users in the affected region to mitigate the impact and offer technical support.
On-chain tracking: committed funds and capital movements
Blockchain forensics conducted by specialized firms has allowed for mapping the flow of stolen assets across various decentralized networks. YFarmX security analysts identified an initial list of over 450 drained wallets, affecting holders of Bitcoin (BTC), Ethereum (ETH), and Tron. Estimates from independent analysts such as Specter place the total amount diverted at over $86 million, though the exact official figure remains under audit.
According to these reports, the attacker moved approximately 2.810 ETH through privacy tools like Tornado Cash in three consecutive transactions, subsequently diverting some of the funds using protected Zcash accounts. Additionally, the withdrawal of approximately 3,28 million USDC to three separate addresses was detected. Stablecoin issuers have taken swift technical action: Circle is monitoring the linked addresses, while Tether froze 10 million USDT within the first 24 hours of the incident after detecting suspicious transfers.
Despite these interventions, the attackers converted approximately 15 million USDT to the stablecoin USDD and redirected nearly 4,23 million USDT to deposit addresses on exchange platforms. On-chain data suggests that over 15.475 ETH and 203 BTC remain in addresses under the attacker's control, beyond the reach of traditional freezing mechanisms.
Safety guidelines and warnings for users
Following this incident, Ledger has tightened its protocols for official distributors and global resellers. The primary instruction sent to business partners categorically prohibits reintroducing products that have been returned by previous customers into inventory. The company emphasized that any returned unit must be permanently removed from circulation to prevent malicious alterations between transfers.
For users who have purchased devices through CryptoBilis and have not yet configured them, the official recommendation is to completely refrain from using them. Those who have already configured a hardware wallet from this distributor should immediately transfer their digital assets to a new address generated from a blank recovery phrase, preferably configured on a device obtained directly through official channels or managed in secure environments such as Wallet.
The company also warned about the proliferation of phishing campaigns. The support team will never request the 24-word seed phrase via email, phone calls, or direct messages on social media, reminding users that the security of private keys relies solely on physical isolation.
Self-storage, authorized providers and the European regulatory framework
The incident reopens the debate surrounding the risks associated with the physical manipulation of devices (tampering) and reliance on unverified distributors. To gain a deeper understanding of attack vectors in private key management, users can consult training guides at [link to guides]. Bit2Me Academy, where the difference between delegated custody, hybrid custody, and pure hardware solutions is analyzed.
Within the European Union, the MiCA Regulation imposes rigorous standards of due diligence, data governance, and traceability on Crypto Asset Service Providers (CASPs). While MiCA primarily regulates entities that provide custody and trading services, hardware vulnerabilities underscore why regulated operators require strict audits of their technical infrastructure integrations. Having providers supervised by bodies such as the CNMV in Spain ensures compliance with operational safeguards designed to protect both retail and institutional holders against unforeseen breaches.
FAQ
What exactly happened to the Ledger devices sold by CryptoBilis?
The devices distributed by the Southeast Asian reseller were subjected to external tampering that compromised the security of users' recovery phrases. Ledger confirmed that its own core systems remain intact and that the incident is limited to units sold through this specific intermediary channel.
What should I do if I bought a hardware wallet from CryptoBilis?
If you haven't yet set up the device, do not use it under any circumstances. If you already have funds associated with that drive, transfer them immediately to a secure wallet created with a completely new recovery phrase, preferably obtained directly from official sources or audited platforms.
Are Ledger devices purchased directly from the official store affected?
No. Ledger's technical audits have determined that the direct supply chain and official software are unaltered. The confirmed cases correspond exclusively to units managed by the regional distributor CryptoBilis, which has ceased selling these products.
The security of digital assets depends on both technological rigor and the integrity of the supply chain at every stage. Acquiring devices and operating through verified entities significantly reduces exposure to malicious manipulation.
Staying informed about best practices for self-custody and relying on platforms regulated under European standards ensures a solid and transparent operational experience.
Investing in cryptoassets is not fully regulated, may not be suitable for retail investors due to high volatility and there is a risk of losing all invested amounts.
Generative artificial intelligence tools were used to create this article.
