Ledger has narrowed its investigation into a wallet-draining incident reported on October 9, saying all confirmed cases so far involve devices sold by Southeast Asia reseller CryptoBilis. The hardware wallet maker said its own systems and direct sales channels were not affected.

The update follows reports that users who bought devices through CryptoBilis lost funds, with on-chain analysis indicating more than $86 million was drained from hundreds of wallets on Ethereum, TRON, and Bitcoin. Galaxy Research’s Alex Thorn estimated the losses at about $91 million.

What Ledger says it has confirmed

According to Ledger, every confirmed case tied to the October 9 incident involves a device sold through CryptoBilis. The company said the number of affected devices is limited, while adding that it is continuing to contact impacted users and work with authorities.

Ledger also said one affected customer’s device contained an unauthorized hardware implant. The company did not state that this implant explains every reported theft, and it has not said whether a single method accounts for all of the losses under review.

Scale of the reported losses

The incident drew attention after reports of large-scale fund theft from users in Southeast Asia who had purchased Ledger devices from the reseller. On-chain analysis cited in the report showed more than $86 million drained from hundreds of wallets across Ethereum, TRON, and Bitcoin.

A separate estimate from Galaxy Research’s Alex Thorn put the amount stolen at roughly $91 million. Ledger’s latest statement provides more detail on the sales channel involved, but it does not appear to settle the full cause of each case.

Advice for CryptoBilis customers

CryptoBilis has confirmed that it has stopped selling hardware wallets. Ledger said customers who bought devices from the reseller should not initialize any unused unit they still have.

For users who already set up a seed on a CryptoBilis-purchased device, Ledger advised moving funds to a new seed created on a device purchased directly from Ledger. The company also urged affected users to contact Ledger Support through official channels and to file complaints with their local law enforcement authorities.

Broader warning and next steps

In its public guidance, Ledger reiterated that users should avoid unauthorized resellers, saying the risk of suspicious, counterfeit, or modified devices is significant when products do not move through Ledger’s security guidelines.

For now, the clearest confirmed next step is the ongoing investigation. Ledger says it is still examining the incident, coordinating with authorities, and distinguishing confirmed cases from broader reports as it continues outreach to affected users.

Source: dailyhodl.com