Ledger pauses CryptoBilis sales after modified wallet discovery

Ledger investigates CryptoBilis wallet sales

Cryptocurrency hardware maker Ledger has temporarily paused sales through reseller CryptoBilis after reports that customers in Southeast Asia lost funds from devices bought through the retailer. Pseudonymous blockchain investigator Specter put the reported losses at more than $86 million.

Ledger said it was investigating the incidents and later confirmed that one affected user’s device contained an unauthorised hardware implant. The company said the investigation remains ongoing and that it is contacting affected users.

In an October 11, 2026 update, Ledger described the affected population as a “limited” number of devices. It added that every confirmed case involved products sold through CryptoBilis, rather than devices obtained through other sales channels.

Customers urged not to initialise recent purchases

Ledger advised customers who bought from CryptoBilis within the past 90 days not to begin setup if their device has not yet been configured. Customers who have already set up a device were advised to consider moving assets to a new Ledger signer using a newly generated seed.

CryptoBilis has stopped selling all hardware-wallet inventory while the inquiry continues. In its customer alert, the reseller stressed that a recovery phrase must be generated by the device during setup and written down by its owner.

A device delivered with a recovery phrase already printed or written on a card or sheet should be treated as unsafe, CryptoBilis said. The same applies if anyone other than the owner has seen the phrase. The reseller also warned users never to disclose a recovery phrase or PIN, and said offers to recover stolen funds are almost always scams.

Supply-chain controls are central to the response

Ledger told resellers and distributors to obtain products only through authorised channels and not to restock returned devices. It also cautioned users against buying from unauthorised resellers, where devices may be suspicious, counterfeit or modified and may not operate under Ledger security guidelines.

The incident highlights a practical control for organisations and high-value asset holders: hardware wallets should be procured through approved channels, checked before deployment, and initialized by the intended user alone. Any device with a pre-supplied recovery phrase, unexplained modification, or uncertain chain of custody should be removed from use and replaced with a newly configured signer.