A Ledger security alert circulated in October 2026 after users reported roughly $86 million drained from crypto wallets. An on-chain investigator traced funds to theft addresses on Ethereum, Tron and Bitcoin, and Ledger asked one reseller to pause sales and shipments; no device exploit has been confirmed.
What Ledger said about CryptoBilis
Ledger Support posted on X on October 10, 2026 that the company is investigating reports of lost funds from Southeast Asian users who bought products from a reseller named CryptoBilis. As a precaution, Ledger asked that reseller to pause all sales and shipments. The company advised buyers from that reseller in the last 90 days not to start device setup if they have not already, and said those who have set up a device should consider moving assets to a new signer with a new seed.
On-chain tracing and loss estimates
On-chain investigator Specter (SpecterAnalyst) traced more than $86 million into theft addresses after users posted drain reports on X and Reddit; he said the money came from hundreds of wallets but that he still lacks a full count. Tracker totals vary: one report placed Specter’s figure near $86.96 million across 98 addresses, researcher tanuki42 estimated more than $72 million, MistTrack reportedly counted almost $90 million, and Bitquery reported about $92.9 million across 311 wallets and five chains. None of these totals has been confirmed, and no reviewed source explains the gaps, so the true loss remains unverified.
Cause, device exploit and supply-chain questions
Reports say Ledger has found no evidence that its systems or wallet software were compromised. Because the reported losses center on devices sold through a single reseller, a supply-chain attack has been described as a possible but unconfirmed cause. Security researcher Taylor Monahan warned that posts were stoking panic about a zero-day flaw when none appeared to exist. The exact cause of the wallet drains remains unverified.
Advice for affected buyers
The instructions reported apply specifically to CryptoBilis buyers from the last 90 days. Sources reviewed show no similar instruction for other buyers. On hardware wallet security, a basic rule reiterated by sources is that a seed phrase should never be entered into a website or app. The company named support.ledger.com as the official channel for questions.
What to watch next
Readers should follow three items for updates: whether Ledger confirms the cause of the drains, whether it publishes its own loss count, and whether totals from on-chain trackers converge. The alert currently centers on one reseller rather than a confirmed flaw affecting all devices; the size of the traced losses and their cause remain open pending further statements from Ledger.
