Ledger Warns Users After Reports of $86 Million Crypto Theft

Highlights:

• Ledger is investigating reports of stolen crypto funds involving customers who purchased wallets from reseller CryptoBillis.
• Blockchain investigator Specter estimates over $86 million in crypto losses across hundreds of wallets on multiple networks.
• Ledger urges recent CryptoBillis customers to take precautions while investigators work to identify the cause of the thefts.

Crypto hardware wallet maker Ledger is investigating reports of stolen funds involving users in Southeast Asia who purchased devices from reseller CryptoBillis. Meanwhile, blockchain investigator Specter estimates that more than $86 million in cryptocurrency has been stolen from hundreds of wallets across several networks. However, the exact cause of the thefts remains unknown.

Ledger confirmed the investigation in an official X statement on October 9, 2026. The company said it had asked CryptoBillis to suspend sales and shipments of Ledger devices while the investigation continues. It also issued safety instructions for customers who recently purchased wallets from the reseller.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices.…

— Ledger Support (@Ledger_Support) October 9, 2026

Ledger Asks CryptoBillis to Suspend Device Sales

Ledger said it was investigating reports of missing funds from customers who bought hardware wallets through CryptoBillis in Southeast Asia. The company has not confirmed whether the devices were compromised or how the reported thefts occurred. As a precaution, Ledger advised anyone who purchased a device from CryptoBillis in the past 90 days not to complete the initial setup if they haven’t already.

For customers already using these devices, Ledger recommended transferring their cryptocurrency to a new Ledger signing device with a fresh recovery phrase.

In its statement, Ledger said:

“If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.”

A recovery phrase, also called a seed phrase, allows users to regain access to their cryptocurrency wallets. Anyone who obtains that phrase may be able to access the associated funds. Ledger also asked affected customers to contact its official support channels with questions. However, it has not disclosed the number of affected customers or confirmed the total financial losses.

On-Chain Investigator Estimates Crypto Losses Above $86 Million

Separately, blockchain investigator Specter reported finding suspicious cryptocurrency transfers involving Ledger users. The investigator said complaints on X and Reddit reported funds disappearing from hardware wallets. After examining blockchain transactions, Specter identified addresses receiving cryptocurrency from hundreds of suspected victim wallets.

The investigation covered several major blockchain networks, including Bitcoin, Ethereum, and TRON. Specter estimated the combined losses at more than $86 million. The investigator also shared wallet addresses linked to the suspicious transfers, allowing others to examine the transactions.

According to the findings, the suspected thefts involved multiple cryptocurrencies rather than a single token or blockchain network. However, Specter’s independent analysis produced the $86 million estimate. Ledger has not confirmed that figure or established whether all the identified transactions are connected to the CryptoBillis investigation.

Cause of Ledger Wallet Theft Remains Under Investigation

The reported losses have raised questions about the security of the affected hardware wallets. These devices normally store private keys offline, helping protect cryptocurrency from online attacks. However, Ledger has not identified a technical vulnerability in its hardware wallets. Investigators have also not established whether the reported thefts involved compromised devices, exposed recovery phrases, or another method.

Meanwhile, Binance co-founder Changpeng Zhao (CZ) warned Ledger users to remain cautious, especially those who recently purchased a hardware wallet. In an X post, CZ said the incident appeared to involve a supply chain attack linked to a single vendor. He suggested that a small number of customers may have received fake or tampered Ledger devices. However, investigators have not confirmed this as the cause of the thefts.

CZ also advised users to wait a couple of weeks before transferring large amounts of cryptocurrency into a newly purchased hardware wallet. He recommended following security news during that period to identify any reported hacks or device-related risks.

One security tip.

When you buy a hardware wallet (or download a new software wallet), leave it for a couple of weeks before moving any meaningful amount of funds to it.

And follow the news in those weeks (and after), for hacks, etc. Hardware can be tempered with, software… https://t.co/TFsx64UihY

— CZ 🔶 BNB (@cz_binance) October 9, 2026

Ledger has not announced when it will complete its investigation. For now, the company continues to urge recent CryptoBillis customers to follow its safety guidance. The investigation will determine how the funds were stolen and whether the reported incidents are connected.