Ledger is investigating suspected digital asset theft linked to devices sold by CryptoBilis, a hardware wallet reseller in Southeast Asia. Blockchain researchers now estimate that around $93 million has been stolen from hundreds of wallets, although Ledger has not confirmed the total.

The investigation began on October 9, 2026, after users reported that funds had disappeared from their wallets. Researchers suspect that some Ledger devices may have been tampered with before reaching customers, but the exact cause of the reported thefts remains under investigation.

The case has raised concerns about the security of hardware wallets, which many bitcoin holders use to protect their BTC.

Ledger said it had asked CryptoBilis to stop selling and shipping its devices while the investigation continues. The reseller is listed as an authorized distributor serving Malaysia, Indonesia and the Philippines.

Ledger advised customers who bought devices from CryptoBilis within the previous 90 days not to set them up if they had not already done so. Customers who had already activated their devices were advised to consider moving their funds to a new device with a newly generated recovery phrase.

Ledger has said that its own systems and services were not compromised and that the reported problem appears to be linked to the reseller.

Blockchain investigator Specter initially estimated that more than $86 million had been stolen from hundreds of wallets across Bitcoin, Ethereum and TRON.

Another researcher, tanuki42, identified wallet addresses allegedly linked to more than $72 million in losses.

Blockchain analytics firm Bitquery later reported a higher figure of approximately $92.9 million across 311 wallets. Its analysis covered five networks: Bitcoin, Ethereum, TRON, BNB Chain and Polygon.

A subsequent estimate put the losses at around $93.2 million across 315 wallets and six networks. These figures are based on blockchain analysis and have not been independently confirmed by Ledger.

BitQuery also disputed Ledger’s claim that devices set up more than 90 days ago have not been affected. According to BitQuery’s investigation, 8 out of 10 victims received funds at their addresses starting in June.

TRON accounted for most of the reported losses, at approximately $70.5 million, mainly in USDT stablecoins. Bitcoin losses were estimated at $16.8 million, involving 203.8 BTC. Ethereum accounted for around $3.7 million, with smaller amounts attributed to BNB Chain and Polygon.

Researchers also found transactions suggesting that the suspected attacker tested transfers weeks before the reported thefts. These transactions may indicate advance planning, although they do not prove how the attacker gained access to the wallets.

One of the main concerns is that some devices may have been modified before being sold to customers.

Former Mt. Gox chief executive Mark Karpelès said he found a hidden electronic component behind the screen padding of a Ledger device he purchased through a Malaysian channel.

He described a component containing an antenna and a SIM-style chip.

Separately, 23pds, chief information security officer at blockchain security firm SlowMist, described a possible device modification that could record recovery words displayed during setup and transmit them through a cellular connection.

If such a device captured a user's recovery phrase, an attacker could access the wallet without needing to steal the device itself.

Ledger's Genuine Check verifies that a device contains an authentic security chip. However, that check may not detect every physical modification elsewhere in the device, especially if other modules are added in parallel to the existing hardware.

Adding to an already tense situation, reports have emerged of a potentially modified Ledger device purchased from an authorized reseller in Europe. Any connection to the CryptoBilis investigation remains unconfirmed.

Investigators are working to trace the stolen digital assets and prevent it from moving further.

Tether, the company behind USDT, has frozen some tokens linked to the suspected thefts. An earlier analysis estimated that approximately $10 million had been frozen, although the amount that victims may recover remains uncertain.

Freezing USDT can prevent transfers from targeted addresses, but it does not automatically return the funds to their rightful owners. This is possible because Tether centrally controls USDT. Bitcoin and Ethereum, by contrast, are decentralized networks, meaning neither Tether nor any other single entity can directly freeze their native assets at the protocol level.

The investigation has raised an important question for bitcoin holders: how much protection does a hardware wallet provide if the device itself has been tampered with before purchase?

And now, even buying a device from an authorized reseller does not necessarily guarantee that the device is genuine and secure. Every part of the supply chain is important.