Hardware wallet manufacturer Ledger is investigating a series of cryptocurrency wallet drains linked to devices sold by Southeast Asian reseller CryptoBilis, also known as CryptoBillis.
In a statement posted on October 9, Ledger advised customers who purchased devices from the reseller within the previous 90 days not to initialize them if they had not already done so.
Those who had set up their devices were encouraged to transfer their assets to a new Ledger device with a freshly generated seed phrase.
Ledger has said its infrastructure, systems, and services were not compromised, and that the investigation appears to concern the reseller and affected market.
The cause of the losses has not been conclusively established, although industry observers have raised the possibility of a supply-chain issue involving devices distributed through the reseller.
Amount lost
On-chain analysts estimate the wallet drains have cost users nearly $90 million, with some independent estimates putting the figure at $92.9 million across hundreds of addresses. The affected customers appear concentrated in Indonesia, Malaysia, and the Philippines.
Blockchain researchers observed coordinated transfers from victim wallets across multiple networks, including TRON, Bitcoin (BTC), Ethereum (ETH), BNB Chain (BNB), and Polygon.
Most of the value was transferred in USDT on TRON, alongside substantial amounts of Bitcoin and smaller quantities of ether and other tokens. Tether has frozen approximately $10 million in USDT linked to the activity as investigators track the remaining assets, some of which have already been moved through mixers.
Affected wallets
Lookonchain highlighted several cases illustrating the scale of the losses. One Bitcoin address received 80 BTC roughly 10 days before the funds were swept out in a single transaction on the morning of October 9. The coins had been acquired four months earlier at around $65,000 each.
Another case involved a TRON wallet identified as TY24Ya, which held 7 million USDT after its owner purchased a device from the same reseller three weeks earlier.
The entire balance was transferred out during the first wave of activity. A third case tracked by the same analyst involved Ethereum address, which lost 59 ETH after its owner moved funds from a long-dormant wallet to a newly activated one.
The incident comes amid mounting losses from cryptocurrency-related cyberattacks. According to a Finbold Research report, cryptocurrency hacks accounted for more than $1.17 billion in losses during the third quarter of 2026, bringing the year’s total to approximately $2.1 billion.
The report, which used incident data tracked by SlowMist, also identified a separate $100 million Coldcard incident involving a hardware wallet, highlighting the security risks facing cryptocurrency holders even when using physical storage devices.
Featured image via Shutterstock
