Ledger SAS is investigating cryptocurrency losses among Southeast Asian customers who bought its hardware wallets from CryptoBilis, a Petaling Jaya-based authorised reseller serving Malaysia, Indonesia and the Philippines, after asking the reseller to halt sales on 9 October 2026. The company has since confirmed an unauthorised hardware implant in one affected device. An on-chain investigator estimates the suspected losses at more than US$86 million, and the case has raised questions about supply chain security in the region’s digital asset custody market.
Key Facts At A Glance
- Ledger asked CryptoBilis to pause all sales and shipments of its devices on 9 October 2026.
- CryptoBilis is headquartered in Petaling Jaya, Selangor, and is listed as an authorised Ledger reseller in Malaysia, Indonesia and the Philippines.
- On-chain investigator Specter estimated suspected losses at more than US$86 million across Bitcoin, Ethereum and Tron. Ledger has not confirmed the amount or the number of affected customers.
- Ledger confirmed that one affected customer’s device contained an unauthorised hardware implant.
- Ledger said all confirmed cases linked to the 9 October draining incident involve devices sold through CryptoBilis, and that its own systems and direct sales channels were not affected.
- CryptoBilis has stopped selling hardware wallets, according to Ledger.
- Ledger said it is working with relevant authorities and reviewing its reseller controls and anti-tamper processes.
French hardware wallet maker Ledger is investigating reported cryptocurrency thefts involving customers who purchased its devices through CryptoBilis, an authorised reseller headquartered in Petaling Jaya, Selangor. CryptoBilis is listed as an official Ledger reseller in Malaysia, Indonesia and the Philippines.
On 9 October 2026, Ledger said through its support account on X that it had asked CryptoBilis to pause all sales and shipments of Ledger devices as a precaution while it investigates. It advised customers who bought from the reseller in the previous 90 days not to set up their devices if they had not already done so, and recommended that those who had set them up consider moving assets to a new Ledger device with a new recovery phrase.
Loss Estimates Remain Unconfirmed
On-chain investigator Specter estimated suspected losses at more than US86 million after tracing funds sent to suspected theft addresses on Bitcoin, EthereumandTron. Other researchers have separately placed estimates between US72 million and US$86 million.
Ledger has not confirmed any loss figure or the number of affected customers. It has also not established that the full estimates relate to CryptoBilis buyers.
Ledger Confirms Implant In One Device
In a subsequent update, Ledger confirmed that one affected customer’s device contained an unauthorised hardware implant. The company has not established whether other devices were compromised in the same way, and it has not publicly identified the cause of the wider losses.
In a 72-hour update on 11 October, Ledger said all confirmed cases linked to the 9 October draining incident involved devices sold through CryptoBilis. It described the number of affected devices as limited and said its systems and direct sales channels remained unaffected. In a separate statement, the company said it had received no reports involving devices purchased directly from Ledger.
Ledger said it is working with relevant authorities, contacting affected users, and reviewing authorised reseller controls and hardware protections. It also acknowledged support from the security incident response group SEAL 911. The company reminded its resellers and distributors to source products only through authorised channels and never to restock returned products.
Ledger confirmed that CryptoBilis has ceased all sales of hardware wallets. Affected users were advised to contact Ledger Support through official channels and file complaints with local law enforcement. The company also warned that it will never ask customers for their 24-word recovery phrase.
Ownership Change And Industry Response
CryptoBilis’ former co-founders, Arravind Prabu and Vimalatheethan, said in a statement that the company was acquired by new owners earlier in 2026 and that they completed the handover of operational responsibilities in March. They said they no longer have access to the company’s systems, customer records or daily operations, and that suppliers including Ledger and Trezor had been informed of the ownership change. Ledger’s public statements have not linked the ownership change to the losses.
CoinGecko co-founder and CEO Bobby Ong said on 10 October that buying hardware wallets from resellers carries added supply chain risk, even when they are authorised, and recommended buying directly from manufacturers. David Low, co-founder and CEO of Malaysian exchange Hata, suggested that hardware wallet sellers be brought under Malaysia’s digital asset custody regulatory framework and called on Ledger to clarify how it monitors its reseller network.
Publicly available information on the incident remains limited. The total value lost, the number of affected customers and the method behind the thefts have not been confirmed, and no statement from a Malaysian regulator on the incident has been publicly reported.