Market tone: Bullish
John Chen · Crypto Briefing · 2026-10-10T16:40:43.000Z
Ledger logo by Wikimedia contributor, CC BY-SA 4.0
The hardware wallet maker has told Southeast Asian reseller CryptoBilis to halt sales while it probes reports of drained accounts and alleged spy implants
Ledger has opened an investigation into a wave of reported fund losses among customers in Southeast Asia. The common thread so far is devices bought through CryptoBilis, an authorized Ledger reseller operating in Indonesia, Malaysia, and the Philippines.
What Ledger is telling customers
Ledger announced the probe on October 9, 2026, and instructed CryptoBilis to stop all sales and shipments immediately.
The guidance for buyers depends on whether they have opened the box. Anyone who bought from the reseller in the last 90 days and has not set up the device yet should leave it uninitialized.
Customers who already set up a wallet are being urged to move their assets to a new Ledger device. That new device should generate a completely fresh seed phrase.
Ledger has drawn a firm line around its own infrastructure. The company says its systems and the devices it sells directly have not been compromised.
The alleged spy hardware
The tampering theory took shape on social media. Photos and videos posted on X and Threads appear to show a small circuit board tucked beneath the device’s screen.
According to those posts, the implant allegedly captures whatever appears on the display. That would include the recovery phrase shown during initial setup, which is the moment the wallet is most exposed.
The board reportedly carries an embedded SIM card. The claim is that it relays captured data over a cellular connection straight to the attacker, who can then empty the victim’s wallet at leisure.
The news moving money, markets, and the world—before your day starts.
Daily. Free. Join 34,000+ readers across crypto, finance, and policy.
We respect your privacy. Unsubscribe anytime.
Mark Karpelès, the former CEO of Mt. Gox, examined some of the suspect devices. He has called for further investigation.
As of October 10, 2026, no definitive link had been confirmed between the alleged hardware tampering and CryptoBilis. The investigation remains open.
How much may have been taken
The dollar figures come from onchain analysts, not from Ledger. Analytics outfits Specter and tanuki42 flagged a pattern of inflows to suspected theft addresses across multiple blockchains, with loss estimates ranging between $72 million and $93 million.
Arkham Intelligence tracked around $87 million at one point across various wallets. The holdings reportedly include significant amounts of Ethereum (ETH), Bitcoin (BTC), and Tether (USDT).
Ledger has not confirmed any of these numbers.
Tether froze approximately $10 million in USDT linked to some of the alleged theft addresses.
CryptoBilis was reportedly linked to a recent change in ownership connected to an individual from China. No wrongdoing tied to that ownership change has been established.
What this means for wallet buyers and Ledger
For anyone holding a Ledger bought through CryptoBilis, the practical steps are clear. Follow the company’s guidance, move funds to a fresh device with a new seed phrase, and do not wait for the investigation to finish.
The key things to watch are whether investigators confirm a physical link between the implants and CryptoBilis, whether Ledger publishes its own loss figures, and whether more issuers follow Tether in freezing linked funds.
Originally published by Crypto Briefing.