Ledger confirms hardware wallet draining cases linked to CryptoBilis-sold devices

On October 10, 2026, Ledger confirmed that hardware wallets sold through Southeast Asian reseller CryptoBilis contained unauthorized physical implants, enabling attackers to drain between $72 million and $94.5 million across more than 300 wallets on multiple blockchains, primarily in USDT on Tron. Tether froze approximately $10 million in USDT, while security firm PeckShield traced millions in stolen funds to Binance deposit addresses. Ledger reported its direct sales channels remain secure.

Reseller compromised by tampered devices

• ▪Ledger confirmed that all documented hardware wallet draining cases linked to CryptoBilis-sold devices involved devices purchased from reseller CryptoBilis within three months prior to October 10, 2026
• ▪On October 10, 2026, Ledger confirmed that hardware wallets sold by Southeast Asian reseller CryptoBilis contained unauthorized physical implants that exposed users' recovery seed phrases to attackers
• ▪Authorized reseller CryptoBilis distributed authentic, sealed Ledger hardware wallets across Indonesia, Malaysia, and the Philippines before compromised units sold by CryptoBilis entered circulation

Ledger response and customer guidance

• ▪Ledger issued a directive reminding all authorized resellers that returned hardware wallet products must never be restocked or resold
• ▪Ledger officially suspended hardware wallet sales through reseller CryptoBilis following confirmation of physical device tampering
• ▪Ledger advised customers who purchased devices from CryptoBilis not to initialize unused units and to transfer existing crypto assets only after generating new seed phrases

Financial losses and targeted cryptocurrencies

• ▪Approximately $70 million of the total funds stolen from compromised CryptoBilis-sold Ledger devices consisted of USDT on the Tron blockchain
• ▪Stolen assets from CryptoBilis-sold Ledger devices were swept across multiple blockchains, including Bitcoin, Ethereum, BNB Chain, Polygon, and Solana, following the exposure of compromised recovery seed phrases
• ▪Attackers drained between $72 million and $94.5 million across 311 to 315 compromised cryptocurrency wallets beginning on October 9, 2026

Freezes and laundering of stolen funds

• ▪Stablecoin issuer Tether froze approximately $10 million in USDT tied to blockchain addresses involved in the Ledger wallet draining incident
• ▪Following Tether's address freezes, attackers behind the CryptoBilis-linked wallet draining attempted to evade further asset freezes by converting stolen USDT into USDD stablecoins and routing funds through cryptocurrency mixers

PeckShield tracking transfers to Binance

• ▪PeckShield identified that an earlier transfer of approximately $10 million in USDT stolen from CryptoBilis-sold Ledger devices had also been routed into Binance deposit addresses on October 11, 2026
• ▪Blockchain security firm PeckShield reported on October 11, 2026, that attackers behind the CryptoBilis-linked Ledger wallet draining transferred approximately $3.89 million—comprising 3.685 million USDT and 615,000 TRX—into Binance deposit addresses on the Tron network
• ▪PeckShield noted that funds stolen from CryptoBilis-sold Ledger devices passed through multi-client intermediary wallets prior to entering Binance deposit addresses, complicating identity attribution

Debatable claims

• ▪Physical supply chain tampering invalidates the cold storage security model
• ▪Ledger bears responsibility for losses caused by tampered devices sold through its authorized resellers
• ▪Third-party resellers pose an unacceptable security risk for hardware wallet distribution
• ▪Tether's power to freeze stolen stablecoins is justified to mitigate major crypto thefts