Ledger devices sold through CryptoBilis (supply-chain attack) hack — October 2026

Hundreds of people who had bought Ledger hardware wallets through CryptoBilis, a reseller distributing Ledger devices in Indonesia, Malaysia and the Philippines, lost about $93.2 million on 9 October 2026 in one coordinated drain. According to an on-chain investigation by Bitquery, the main wave began at 05:07 UTC, when dozens of wallets on TRON, BNB Chain, Polygon and Ethereum signed the same approval within seconds of each other; 111 Bitcoin wallets were emptied in a single block at 05:54 UTC, and further wallets were drained through the day, the last at 16:37 UTC. Bitquery counted 315 victim wallets on six chains: $70.5 million from 131 TRON wallets, almost all of it USDT; 203.8 BTC, about $16.8 million, from 122 Bitcoin wallets; $3.7 million on Ethereum; $1.45 million on BNB Chain; $0.58 million on Polygon; and about $250,000 on Solana, all valued at prices on the morning of 9 October.

The pattern points to one party holding every victim's keys. Bitquery found that the thief's control addresses on TRON and Ethereum were funded on 25 September and ran about twenty test cycles each over the next two weeks: send a wallet a few dollars and some gas, have it approve, pull the money back. The last two tests ran 23 seconds apart on 7 October. On TRON, 30 of the wallets had a new key added to their permissions minutes before the drain. The investigator Specter first put the loss above $86 million from ten public theft addresses. The $93.2 million headline is Bitquery's count of money leaving victim wallets, excluding transfers between the thief's own addresses; $86 million is kept as the lower end.

Ledger said on 9 October that it was investigating losses among users who had bought from CryptoBilis, asked the reseller to pause all sales and shipments, and told anyone who had bought from it in the previous 90 days not to set up the device and, if they already had, to move their assets to a new device with a new recovery phrase. On 10 October it said one victim's device contained an unauthorised hardware implant, after the former Mt. Gox chief executive Mark Karpelès published photographs of a Nano X bought in Malaysia with an extra module hidden behind the screen. In a 72-hour update on 11 October Ledger said the number of affected devices was limited, that every confirmed case involved devices sold through CryptoBilis, that its own systems and direct sales channels were unaffected, and that it was working with the authorities. CryptoBilis has stopped selling hardware wallets. Where in the supply chain the devices were altered, and by whom, has not been established.

Tether blocked 37 addresses on 9 October and froze about $10.0 million of USDT, later lifting the block on four wallets Bitquery describes as OTC desks; about 10 million USDD that the thief also took cannot be frozen by Tether. Over 9 and 10 October about 2,990 ETH went through Tornado Cash and on into Zcash and USDC, and PeckShield traced about $3.89 million to Binance deposit addresses on TRON. Frozen funds are not recorded as recovered, and nothing has been returned to victims.