Ledger CryptoBilis drain: what is confirmed and what to do
Short answer: If your Ledger hardware wallet was bought from the reseller CryptoBilis (Malaysia, Indonesia, the Philippines), do not use it: wallets set up on such devices were drained on 9 October 2026. Ledger's guidance is not to initialize an unused device, and if you already set one up, to move your funds to a new device with a new recovery phrase. If your device came from the manufacturer or another source you can verify, there is no public report linking it to these thefts.
What happened, in short
- From 9 October 2026, users in Southeast Asia reported empty hardware wallets on X and Reddit.
- The common link reported so far is that the devices were bought through CryptoBilis, a reseller in Malaysia, Indonesia and the Philippines that several outlets described as an authorized Ledger distributor.
- Ledger asked the reseller to pause all sales and shipments, said it is investigating, and, per press reports, confirmed an unauthorized hardware implant in one affected device. It also said its own systems and infrastructure were not breached.
Confirmed, reported and unknown
| Topic | Status |
|---|---|
| Losses tied to devices bought via CryptoBilis | Ledger is investigating; it acknowledged the reports (as reported). |
| Hardware implant in a device | Ledger confirmed one affected device contained an unauthorized implant (as reported). |
| Ledger's own systems breached | Ledger says no. |
| CryptoBilis was sold | Its former co-founder confirmed a sale in March 2026. No evidence links the sale to the thefts. |
| How the recovery phrases were obtained | Unknown. Researchers have speculated about a hidden module; others about pre-set devices or a reseller data breach. |
| Total losses | Estimates range from about 72 million to more than 90 million USD. Not confirmed. |
| Devices from other sellers | No public report links them to these thefts. |
Who may be affected?
Ledger's advice covers buyers of the past 90 days who purchased through CryptoBilis. One researcher's analysis of the first deposits into drained wallets suggests the exposure could reach back to June 2026; that is an inference from deposit dates, not proof of when a device was bought. If you bought through that reseller at any point this year, treat the device as untrusted until you know more.
If you bought a Ledger from CryptoBilis
- Unused device: do not initialize it, and do not enter or write down any recovery phrase on it.
- Already set up: get a new device directly from the manufacturer and create a new recovery phrase on it yourself.
- Move funds from the old wallet to the new one, one chain at a time, starting with the largest balance. Do this on a clean computer.
- Never reuse the old recovery phrase in any wallet or app, and do not type it anywhere.
- Revoke old approvals afterwards for any token you still hold on the old address; see unlimited token approvals.
- Check the old address on-chain (next section) for transfers you did not make.
How to spot a device you should not trust
- The box contains a recovery phrase card that is already filled in, or instructions to use a phrase supplied by the seller.
- The device is already set up, has a PIN, or shows a wallet when you first power it on.
- The packaging looks opened, resealed or different from the manufacturer's.
- You are told to install a different app, or to connect it to an unknown site, to "activate" it.
No check is a guarantee. Some researchers say a hidden module could still pass the standard device check, and Ledger has not confirmed the mechanism. That is why buying from the manufacturer and generating the recovery phrase yourself is safer than trying to test a device.
Check your address on-chain
Paste your address into Hopchain to see recent activity and connections on Ethereum, Polygon, Arbitrum, Tron and Solana. Look for outgoing transfers you did not make and for approvals to addresses you do not recognise. Hopchain does not cover Bitcoin or BNB Chain yet; use that chain's block explorer. Compare destinations with the addresses researchers published in our case file on the 9 October drains.
Watch out for scams riding the news
- Fake compensation or "recovery" offers in direct messages, comments and ads. Nobody legitimate asks for a fee to recover stolen crypto.
- Fake Ledger pages in search ads that ask for your recovery phrase. Ledger and legitimate wallets never ask for the phrase.
- "Verify your device" links. Reach the manufacturer through a bookmark or by typing the address yourself.
More in how to check if a crypto address is a scam and fake airdrops and spam NFTs.
If you were drained
- Stop using the device and the recovery phrase. Move whatever remains to a new wallet.
- Save transaction hashes, the destination addresses and screenshots.
- Report it to Ledger Support and to your local police or fraud authority. If the funds went to an exchange, tell that exchange.
- For USDT, a quick report matters: Tether can freeze funds that are still at an address.
- Ignore anyone offering to recover the funds for a fee.
Why "official reseller" is not enough
A reseller can change hands without its customers noticing, and the manufacturer's logo on the website tells you nothing about who runs the shop today. In this case the former co-founder says the business was sold in March; no link to the thefts has been shown, and we are not suggesting one. The practical lesson is simpler: buy hardware wallets directly from the manufacturer, and generate your recovery phrase yourself on the device.
Frequently asked questions
Is my Ledger safe?
Ledger says its own systems were not breached, and the reported losses are tied to devices sold
through one reseller, CryptoBilis, in Southeast Asia. If your device came directly from Ledger or
another source you can verify, there is no public report linking it to these thefts. If it came
from CryptoBilis, follow Ledger's guidance and move funds to a new device with a new recovery
phrase.
What is CryptoBilis?
CryptoBilis is a Malaysian reseller that sold hardware wallets in Malaysia, Indonesia and the
Philippines and was described by several outlets as an authorized Ledger distributor. Its former
co-founder said it was sold in March 2026. No evidence has been published that links the sale to
the thefts.
Which Ledger devices are affected?
The reports concern devices bought through CryptoBilis, mostly in the last few months. Ledger
advised buyers from the past 90 days not to initialize unused devices and to move funds from any
device they already set up to a new device with a new recovery phrase. No public report ties the
incident to Ledger devices from other sellers.
How can I check whether my Ledger was tampered with?
There is no simple guaranteed test. Warning signs are a recovery phrase that came pre-written or
pre-filled, a device that is already set up, damaged packaging, or instructions to use a phrase you
did not generate on the device. Some researchers say a hidden module could still pass the standard
device check, so the safest path is to buy from the manufacturer and generate the recovery phrase
yourself.
Should I move my crypto if I bought from CryptoBilis?
Ledger recommends moving assets to a new device with a newly generated recovery phrase if you
already set up a device bought through the reseller. Do the move from the new device's wallet, and
never reuse the old recovery phrase anywhere.
Can stolen crypto be recovered?
Usually not. Blockchain transfers cannot be reversed. In some cases USDT can be frozen by Tether
if it is still at an address, and exchanges can block deposits, so report quickly with the
transaction hashes. Ignore anyone offering to recover funds for an upfront fee.
Found a mistake or have new information? Write to info@hopchain.io and we will correct this page.
Keep reading
- Case file: the Ledger wallet drains of 9 October 2026, read from the chain
- How to check a wallet before sending crypto
- Unlimited token approvals: how to revoke them
- All case files