Cryptocurrency hardware maker Ledger has temporarily paused sales of its products via CryptoBilis following reports of stolen funds linked to devices sold by the reseller.
On Friday, the company said it was investigating reports of loss of funds from users in Southeast Asia who had purchased products from CryptoBilis. The incident is said to have resulted in losses totaling more than $86 million, according to pseudonymous blockchain investigator Specter.
“We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet,” Ledger said in an X post. “If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed).”
The company has since revealed that one of the impacted users’ devices contained an unauthorized hardware implant, and that it’s reaching out to impacted users as part of an ongoing probe into the incident. Out of an abundance of caution, CryptoBilis has ceased sales of all hardware wallet inventory until the investigation is concluded.
“Your recovery phrase must be generated by your device when you set it up, and written down by you,” CryptoBilis said in an alert on its website. “If your device came with a recovery phrase already printed or written on a card or sheet, or if anyone other than you has seen your recovery phrase, treat your wallet as unsafe.”
“Never share your recovery phrase or PIN with anyone. No one from CryptoBilis or Ledger will ever ask for them. Be careful of anyone who offers to recover lost funds; these offers are almost always scams.”
In a follow-up update posted on October 11, 2026, Ledger acknowledged that the CryptoBilis incident has impacted a “limited” number of devices, adding all confirmed cases involve devices sold through CryptoBilis.
The company also advised resellers and distributors to source products only through authorized channels and never to restock returned products.
“Also, we strongly advise users not to purchase from unauthorized resellers, where the risk of buying suspicious, counterfeit or modified devices is important as nothing operates under ledger security guidelines,” it added.
