Ledger wants everyone to calm down. The company says the wallet draining was limited, not companywide. Every confirmed case traces back to devices sold through CryptoBilis, a reseller in Southeast Asia. Ledger put the suspected draining incident on Oct. 9, 2026. Reassuring? Maybe. Complete? Not even close.
Here’s the pitch. Ledger says its own systems were not compromised. Direct sales channels? Unaffected. The company also says nothing indicates its security infrastructure, systems, or services were breached. In other words, the problem lives in a reseller-linked set of devices, not in Ledger’s house. That limited-scope claim became the big new angle in later reporting.
Then there’s the money. On-chain researchers estimated losses at more than $93 million in some reports. Other coverage cited around $86 million. Bloomberg called it an estimated $70 million event. Ledger itself? It hasn’t confirmed any dollar total. It also hasn’t given a precise count of compromised wallets. Early reporting described hundreds of affected wallets, but Ledger did not verify that. So the numbers float around, and nobody official is grabbing them. Tether also froze $10 million in USDT tied to the incident.
Now the surprising part. Some reports described an unauthorized implant in at least one device sold by CryptoBilis. That points toward supply-chain compromise, not a broad platform breach. Photos reportedly show a small circuit board hidden under the device’s screen, and it allegedly captures the seed phrase and transmits it to attackers. Big difference. A hacked platform hits everybody. A tampered supply chain hits whoever bought from the wrong shelf. The strongest unresolved question is whether the trouble began there.
CryptoBilis, for its part, reportedly confirmed it had ceased all hardware wallet sales. Some reports listed the reseller for Indonesia, Malaysia, and the Philippines. Ledger said the confirmed cases are under active investigation. It’s working with relevant authorities. Affected users are being contacted. Standard script, sure, but it’s the script people expect.
The ripple effects spread anyway. Broader resale channel disruption was reported after the incident. Ledger devices were reportedly pulled from some retail shelves in parts of Asia and Europe. So much for limited. The episode raised pointed questions about reseller oversight and distribution controls. Who checks the middleman? Apparently, that’s now everyone’s question.
Look at how fast the story changed. It started as a broad wallet-draining alarm. Now it’s a narrower, reseller-linked incident, at least according to Ledger. The company stressed that the volume of impacted devices was limited. Maybe. But reported losses ran from $70 million to more than $93 million, and Ledger has verified none of it. Limited is a flexible word when the dollars are this large. Cold wallets like hardware devices are meant to minimize exposure to online threats by keeping private keys offline, which is why a tampered device undermines the very protection buyers expect.
